Mastering Active Directory - Second Edition

Read-only domain controllers

With Windows Server 2008, Microsoft introduced a new type of domain controller called the read-only domain controller (RODC). It allows organizations to have domain controllers in locations where data security and network security cannot be guaranteed.

Domain controllers contain a writable copy of the AD DS database. It is replicated among all the domain controllers in the same domain, but the read-only domain controller will have a read-only AD DS database.

This feature is useful in a branch network. Not every branch office of an organization can afford a fully-blown network with a high-speed leased line, a protected data center facility, and IT staff. If it's an Active Directory environment, and if the branch ...