Pages

Showing posts with label Read-Only Domain Controllers / RODC. Show all posts
Showing posts with label Read-Only Domain Controllers / RODC. Show all posts

WHY READ-ONLY DOMAIN CONTROLLERS (RODC) ?

In enterprise level network its common to have HQ(Head Quarters)-Branch Office network. These branch offices may required  to connected with HQ resources for its operations. Most of the time this kind of setup uses WAN links to connect branch  Offices with HQ network. Let's assume we have company called ABC and its HQ is located in Canada Toronto. Due to the  Expansion its need branch office open in London, UK. So the requirement is more complicated as its 2 different countries.  

The users in London office still need to authenticate the company domain environment and access the resources. Let's Look in  
to some of the difficulties, challenges faces with typical this kind of setup.

Lack of Resources
To connect HQ with branch site its required secure, reliable connection. But these connections typically comes with high $$$$ cost. Even though its cost mostly these links will be with speed of 128kb, 256kb, 512kb etc. If users in branch site is authenticating company AD it will use WAN link for the all the authentication, resources access etc. if the number of  users increase in branch site the link utilization just for the AD activities will increased. Also since its between  different geographical locations, different ISP, many facts will affect the reliability of the link as well. what happen if  the WAN link went down on critical business day ? so solution is to deploy AD in branch site and it will be opening whole different range of concerns, problems.

Guide To Install Read-Only Domain Controller (RODC)

Before install a RODC in a domain environment it need to meet the following requirements,

  • Forest function level should be windows 2003 server or higher
  • Needs at least one writable domain controller running windows server 2008 or higher
If forest have any DC running windows server 2003 we need to adjust permissions on DNS application directory partition to allow them to replicate to RODC. It can be done by running adprep /RODCprep from windows 2012 server installation disk \support\adprep folder.
In my demo setup i do have a domain called contoso. Before start lets check the forest function level.
  • To do that, log in to the DC as domain admin and open "Server Manager"
  • Then from tools click on "Active Directory Domains and Trust"
rodc1
  • Right click on domain and select "Properties"
rodc2
As we can see here its runs with windows server 2012 R2 so we do not need to prepare domain
 

RECENT ARTICLES

Recent Articles

BLOG CONTENTS