Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work at a school district with about 30 school sites. Windows 2008 A/D setup - all central at the district office. In A/D, all is under one site, and no subnets defined. One A/D forest and only one domain under that.

We're now looking to start putting RODCs at the schools to put the authentication and DNS out there closer to them.

I haven't worked with A/D sites and subnets, and only a little with RODC password replication. But just got an invite to a meeting to talk about this tomorrow...

If we start breaking down the A/D pieces into sites/subnets, can we also use that as a way to help apply an RODC password replication policy in a way that matches so that only each school sites' users passwords are replicated/cached on their RODC?

share|improve this question

Yes. That's exactly what RODC is for. You put it at locations that have a slow uplink to the PDC. You also must define user accounts whose passwords are replicated to the RODC's.

share|improve this answer

AD sites and Password replication policies on RODCs has nothing in common. AD Sites define replication boundaries. On the other side, PRP dictates who's passwords are replicated to the RODC. The latter is based on user's membership. If you put a RODC in each school, you should definitely create a corresponding AD site/subnet. In simple words: AD Sites/Subnets help clients to locate nearest Domain Controllers, no matter if they are RODCs or RWDCs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.