Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it useful to enhance security by implementing RODC in the same site, which RWDC exist also? Pointing the site user the RODC instead of the RWDC.


share|improve this question

I wouldn't consider implementing a RODC in the same site just so that users are primarily accessing a read-only DC, since all write operations will just be sent to the RWDC. From what I've read, it's best used when:

  • The DC is deployed somewhere that is physically insecure. (e.g. on a tower PC under a desk at a branch office.)
  • Non-IT users will have terminal services access to the DC (hopefully for a very good reason...)
share|improve this answer
I agree, these are the two scenarios MS describes for RODCs. For reduncandy reasons however you should keep a second RWDC at your site in case the first one goes down for patching, maintenance or a defect – leepfrog May 12 '12 at 22:18

Yes, it is useful ... having a RODC on the same site is useful when you have to power down your RWDC for maintenance.

share|improve this answer
Why would you want the additional complexity of an RODC then? Why not just have two RWDCs? – MDMarra May 13 '12 at 0:05
No, it's not useful in any way. Prove your point? – iPath Aug 4 '15 at 0:02

A less common but still useful deployment is when you have application servers located in a DMZ that need read access to your internal Active Directory services. There's a few different security models but one involves extending your forest into the DMZ by placing an RODC there.

See: Active Directory Domain Services in the Perimeter Network

share|improve this answer

Placing RWDC in a site with RODC makes RODC's security features useless. Please read this:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.