Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Read Only Domain Controllers

Posted on 2008-09-30
Last Modified: 2010-03-17
I am looking at introducing a number of 2008 RODC at branch offices and I was wondering about the following:

Are changes instantly replicated from the "ful" domain controller.

Can changes be made on any DC for instant replication or should changes be made on the partner DC to the RODC ?

Can replication times be changed and would this cause any issues ?

thank you
Question by:titn003
1 Comment
LVL 70

Accepted Solution

Chris Dent earned 500 total points
ID: 22604522

> Are changes instantly replicated from the "ful" domain controller.

Depends on the replication schedule set between sites. Generally, no.

> Can changes be made on any DC for instant replication or should changes be made on
> the partner DC to the RODC ?

It depends on the topology and the nature of the change.

Perhaps the most important aspect is replication of password changes. That is covered by this article:


> Can replication times be changed and would this cause any issues ?

Which is perhaps the most important :) Yes and no with the no being dependant on the type of issues you think you might face (or how reliant you are on fields in AD beyond authentication).

AD Sites and Services will allow you to configure your replication topology, frequency and any other scheduling.

The generation of the topology hasn't really changed from 2003. The trick is that RODCs will only allow inbound replication, no local changes, and therefore no outbound replication. RODCs can, of course, only replicate from writeable DCs.

This article covers some of the other frequently asked questions about RODCs:




Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question