Read Only Domain Controller Add All Credentials

Read-merely Domain Controller (RODC)

Posted On April 29, 2021

Read-simply Domain Controller (RODC) holds read-but re-create of Active Directory (AD) database (NTDS.DIT). In this post, I will discuss why RODC holds a read-just copy of Advertising database and why we need it in the enterprise network?

Why do we demand RODC ?

1. Remote offices are non guaranteed physical security. And then read-only copy of the AD database is preferred instead of an RWDC copy of the AD database. If someone gets access of your RODC, they will not be able to make any modify as it holds a Read-only copy of your Ad database
2. RODC but provides authentication to clients. If your role does not have good bandwidth and it is located at the remote site then deploy an RODC for authentication.
3. Since you cannot brand whatsoever change at RODC, it does non participate in outbound replication. However, it participates in inbound replication. Any changes made at RWDC will replicate to RODC as well. It also consumes less bandwidth compare to RWDC
4. If you accept an enterprise application as a service hosted on the cloud and it only needs hallmark with Ad for SSO then I would recommend integrating that awarding with RODC instead of RWDC for security reasons.

Password Replication Policy in Read-only Domain Controller (RODC)

RODC communicates with write-able DC for user hallmark because by default account credentials are not cached locally on RODC. It means whenever a client tries to authenticate, RODC forward that request to the nearest RWDC to validate the user's credential. If yous do not have proficient bandwidth then it may create slowness issues at your site. You can configure Countersign Replication Policy (PRP) for RODC then RODC can cache the Advertising object credential locally and so next time when user will endeavor to cosign with Advert so RODC does not need to forrad this request to RWDC, instead hallmark will be provided past RODC itself.

Let me requite a cursory step almost how to configure PRP for users or computers then RDOC can start caching credential

1. Create a Group for example "PRP-Computer-Objects" for computers and add the COMPUTERS into it which credential yous want to salvage on RODC
2. Create a Group for example "PRP-Users-Objects" for Users add the USERS into it which credential yous want to save on RODC
3. Open "Active Directory Users and Computers" and search for your RODC figurer name
4. Right-click at your RODC (estimator name) and Get to Property
5. You volition see there an choice "Password Replication Policy"
6. Click at Add push, it will prompt another window just select "Allow Passwords for the ……………" OR "Deny passwords for the…………….."
7. If you select "Allow Passwords……………." then RODC will cache the password but if you choose "Deny Passwords……………" RODC will not cache the credential.

By default, the Denied RODC Password Replication Grouping contains the following members whose passwords are not allowed to be cached by an RODC server:

• Enterprise Domain Controllers
• Enterprise Read-But Domain Controllers
• Group Policy Creator Owners
• Domain Admins
• Cert Publishers
• Enterprise Admins
• Schema Admins
• Domain-broad krbtgt business relationship
• Account Operators
• Server Operators
• Backup Operators
• Administrators

By default, the Allowed RODC Countersign Replication Grouping does not contain any members.

Configuring RODC In Windows Server 2016

Though here, I am giving steps to configure RODC for Windows Server 2022 simply information technology is aforementioned for Windows server 2022 besides.

1. Login to the server which you desire to configure as RODC. Assign proper IPs. Ensure that the "Preferred DNS Server" IP is right and it should point to the right DNS server. Generally, AD servers agree DNS role as well, you can put your AD server IP in the "DNS Server" field

2. Make sure you have joined the organization in domain and setup right figurer name.

three. log in to the server with the "Domain Administrator" account. Ensure that y'all are adding the same version of Os as your RWDC is. For example, if your RWDC is Windows Server 2022 and you are adding RODC windows server 2022 and then "Domain Admin" will non be sufficient considering windows server 2022 has a new version of the schema, in this case, either you manually update the schema then use your DA to promote RODC or give your DA permission of "Schema Admin" and "Enterprise Admin". Assuming hither your RWDC is windows server 2022 and you are promoting your RODC at Windows Server 2016.

4. Open theServer Manager console and launch theAdd Roles and Features Wizard

v. Take the default selections until theSelect server rolesfolio displays. Here, select theAgile Directory Domain Services check box and complete the Active

6. Click at "Add Features", it will add all the required feature for ADDS service

7. Now click Next-Next until you lot get Install push. Finally, click at Install push. It volition just install the ADDS role

8. Yous volition run into a yellow exclamation mark on the notification area, it means some task is awaiting. Click on that and then click at "Promote this server to a domain controller"

8. On theDeployment Configuration folio, brand sure that theAdd together a domain controller to an existing domain selection is selected and then clickAdjacent. you will run across your domain name in < Domain: lab.local >. Besides, you will encounter your user account and ensure that the account has Domain Admin permission otherwise it will fail.

9. On the Domain Controllers Options page, select the post-obit checkboxes, set the desired DSRM password, and then clickNextto proceed. You lot tin also check the Ad site proper noun where you lot wish to place this RODC.

• Domain Proper noun System (DNS) server
• Global Catalog (GC)
• Read-but domain controller (RODC)

10. On theRODC Options folio, specify the following options:

• A delegated ambassador account that volition be responsible to manage the RODC.
• Accounts that are allowed to replicate passwords to the RODC.
• Accounts that are denied from replicating the passwords to the RODC.

11. On the Additional Options page, select the nearest health domain controller. Practise not select "Install From Media", I volition give more detail about IFM in another article. Just click on Next

12. Ensure all prerequisites are passed. Click at Install button. Now your RODC installation has started.

13. Your server volition reboot later on it is promoted as RODC successfully. And, once your server is rebooted, now your RODC is gear up.

How to view the electric current credentials that are cached on an RODC?

1. Open theActive Directory Users and Computers window, aggrandize theDomain Controllers node, and then open up theProperties of your RODC server
2. Select theCountersign Replication Policy tab and clickAdvanced

3. On theAvant-garde dialog box, you will see the accounts whose credentials are cached on this RODC.

four. To add the specific users, groups, and computers into Immune list or Denied listing, clickAdd together and select the desired RODC policy.

That is all for Read-only domain controller. You tin can employ same steps and procedure for other Windows Server operating system likewise. Annotate if y'all have any question.

stevensonuself1938.blogspot.com

Source: https://superit.in/read-only-domain-controller-rodc/

Share this post