1

I have a RWDC(A) and two RODC(B and C).i create an OU for each branch in RWDC however the OU and its content will be replicated to all DCs within the domain.

So I want to know can we assign an OU to a certain RODC?

1 Answer 1

3

The mechanism for controlling replication of passwords to a Read-Only Domain Controller (RoDC) is through Password Replication Policy (PRP). Passwords are the only part of the Domain partition of the Active Directory (AD) database that is selectively replicated to RoDC's. All the rest of the objects and attributes will be replicated.

PRP is based on security principals (Groups, Users, etc), not OUs (which are not security principals and do not have Security Identifiers).

It's a little unclear what you're asking, but if you're trying to say that you need to control the scope of replication for all objects in these OUs then, bluntly, either a separate AD Forest or Domain for each site is what you need. If you're doing this for security isolation concerns then separate Forests are really the only way to go.

2
  • thank,i want user in RODC(A) can not login in RODC(B).how can i assign a group of user for each RODC?
    – KF2
    Feb 19, 2014 at 3:59
  • You can't. The product doesn't have that functionality. Feb 19, 2014 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .