Enable RODC to authenticate domain admin accounts

IT Guy
IT Guy used Ask the Experts™
on
What are the processes and group policy settings to change to enable Read-Only Domain Controllers to authenticate domain admin accounts in Server 2016?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
There is no way to do the same, You have to demote and promote the DC with RODC.
MaheshArchitect
Distinguished Expert 2018
Commented:
RODC can't store domain admins credentials by default by design, it has to authenticate these high privileged accounts with r/w dc... There is no alternative / policy for that

There is allowed password replication policy for RODC which can store users  and computers password and so those accounts can authenticate from *RODC* but all high privileged principals are excluded from that policy by default by design and you cannot alter this behaviour
Shaun VermaakTechnical Specialist
Awarded 2017
Distinguished Expert 2018
Commented:
What are the processes and group policy settings to change to enable Read-Only Domain Controllers to authenticate domain admin accounts in Server 2016?
Domain Admins can be authenticated by the RODC if it can talk to another full DC. Other than that, you have to designate a user account that can manage the RODC (stop AD service etc.)

The above applies to password hash caching
IT GuyNetwork Engineer

Author

Commented:
Shaun,

Are there any special settings or group policy settings that need to be enabled to enable a domain admin account to be authenticated by a Read Only Domain Controller (RODC)?
Architect
Distinguished Expert 2018
Commented:
All accounts including domain admins can authenticate with rodc
Question is password caching for domain admins accounts, domain admins password cannot be cached by rodc
So what is problem with that?
The problem is if rw dc is not available, domain admins cannot logon to rodc
I am wondering what u want to achieve with rodc....

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial