Read-Only Domain Controllers in Active Directory
Miles Consulting Corp's Active Directory consultants may deploy a Read-Only
Domain Controller (RODC) to allow an organization to easily deploy a DC in locations
where physical security cannot be guaranteed. RODC hosta a read-only replica of
the database in Active Directory Domain Service (AD DS) for any given domain..
|
|
|
|
Except for account passwords, an RODC holds all the AD DS objects and attributes
that a writable DC holds. By default, no user/computer passwords are stored on an
RODC.
|
|
|
Branch Office
Read only replica AD DB
Unidirectional replication
Credential caching
read-only AD-integrated DNS zone
|
|
|
|
Universal group membership caching automatically enabled for site in which the RODC
is deployed
|
|
Read-Only Attribute Set Prevents replication of sensitive information. Requires
manual configuration.
|
|
RODC Deployment - Incremental Requirements
Windows Server 2003 Forest Functional Mode
Multiple Windows Server 2008 DCs per domain are recommended to load balance RODC
ewplication.
|
|
RODC is advertised as the Key Distribution Center (KDC) for the branch office.
By default an RODC will not store user or computer credentials except for its own
computer account and a special "krbtgt" account (the account that is used for Kerberos
authentication) Each RODC has a unique "krbtgt" account.
|
|
RODC can be combined with Windows BitLocker Drive Encryption to provide enhanced
data security for branch offices through boot-level hard-drive encryption
|
|
|
|
|
|
Delegated Administartion for RODC
|
|
RODC: administartors can be different users from domain administrator users. Benefits
include:
|
- Prevents accidental modifications of directory data existing outside RODC
- Delegated installation and recovery of RODC
|
|
Delegated Instalattion and Administartion Process for RODC
|
|
(Note: Steps 1 and 2 are not necessarily performed from the same computer)
|
|
|
Pre-Create and Delegate
|
- Domain Administrator uses AD Users and Computers MMC: snap-in to pre-create RODC
- Specifies RODC's FQDN and Delegated Administration group
|
Promote RODC
|
- Delegated Administrator (non-DA) uses DCPROMO Wizard from server to configure as
RODC
- Replicates over network, with support for secure IFM
- Reboots as RODC
|
|
IFM is complementry to replication over the network, but it does not replace the
need for network replication.
|
|