Tag Info

Hot answers tagged

12

It depends completely on what's in the LDAP directory. For Active Directory, absolutely not, even for an RODC - the security profile of these devices is designed for being inside your network (the RODC specifically is hardened against physical compromise, so you can keep it in a closet - a physical compromise of a normal DC would give an attacker control of ...


11

No, it would not be generally acceptable. Not sure what you are trying to achieve but I would say the correct way is to first establish a VPN connection and then connect to LDAP.


8

Your ADUC snap-in, or AD Administration Center (whichever you are using) is likely automatically connecting to your writable domain controller. In ADUC, right click on the domain and click "Change Domain Controller" and point it at your RODC. You won't be able to create objects after you do that.


7

Yes, I did the same thing. Running the /rodcprep command is the last step. Here is the technet article: http://technet.microsoft.com/en-us/library/cc731243(v=ws.10).aspx The RODCs we have work perfectly, and significantly reduced logon time from over 5 mins to under 30 seconds at a remote site serviced by a single T1 line.


7

I wouldn't consider implementing a RODC in the same site just so that users are primarily accessing a read-only DC, since all write operations will just be sent to the RWDC. From what I've read, it's best used when: The DC is deployed somewhere that is physically insecure. (e.g. on a tower PC under a desk at a branch office.) Non-IT users will have ...


7

When using a RODC you really have 2 options for DNS A read only primary zone (yes I know that doesn't sound right, but it is) which is active directory integrated or A standard secondary zone Obviously having a writeable primary zone on a RODC (or in that office) is a security issue. Assuming you have this, and you have setup cached credentials ...


6

An RODC is still a Domain Controller and requires a full or core installation of Windows Server 2008 or 2008 R2. Since it requires a normal installation of Windows and the installation of the Active Directory binaries, it, by definition, requires a server and not an appliance. It needs to be updated and maintained like any other Domain Controller in your ...


6

My first approach to this would be: Create a new domain user and give it rights to join computers to the domain. Embed its username and password into your automation tool (puppet, chef, shell script, whatever). Once all the computers are joined to the domain, you can delete the domain-joining user. If you keep the user, you should change its password or ...


5

In addition to what @joeqwerty says about DNS, you also need to cache the computer accounts on the RODC in addition to the user accounts. Computers log in as well and will be unavailable to unless they are explicitly allowed to on an RODC.


4

It is now possible to use Samba 4 now as an RODC. This actually makes it practical to deploy as an appliance in branch offices. I've been testing this setup for a customer who wants to deploy exactly this environment and it's looking viable. @MDMarra, I'm so sorry.


4

Microsoft does not recommend doing in-place upgrades of Domain Controllers. I'd strongly consider a plan where you demote the DCs one at a time, upgrade them to 2012 with a clean install, and then promote them again. Doing it this way will let you get to 2012 and have whatever features you want. You can make them RODCs, you can make them writable, you can ...


4

In oder to locate the RODC the clients need to be using a DNS server that they can reach and that can resolve the SRV records for the domain. If the clients are using the down server for DNS then they're not going to be able to reach the DNS server and find those SRV records. You should set the RODC as primary DNS and the main office DC as secondary DNS on ...


4

You can't do an upgrade from x86 to x64. You need to do a complete reinstall of the OS. I assume that you have at least 2 DCs (you're a bit unclear here), so if that's the case, follow these steps: Take full backups of both DCs just in case and make sure both are Global Catalogs and run DNS Demote one of the DCs to a member server, moving any FSMO roles ...


4

The Exchange Server setup program requires a writeable Global Catalog Domain Controller (GC) in the Active Directory Site where the server is. A Read-Only Domain Controller (RODC) will not be used. You can't get around this requirement. Either temporarily promote a machine in the Site to be a DC or move the new Exchange Server machine to a different site. ...


3

Just like users, you have to add computer objects to the policy allowing the RODC to authenticate them (link). The easiest way is to create a group of those computer objects and add them to the policy with Allow. Also keep in mind that Site configuration can affect which DC a station will contact.


3

From technet: "When a client that is searching for a domain controller receives the list of domain controller IP addresses from DNS, the client begins querying the domain controllers in turn to find out which domain controller is available and appropriate. Active Directory intercepts the query, which contains the IP address of the client, and passes it to ...


2

The mechanism for controlling replication of passwords to a Read-Only Domain Controller (RoDC) is through Password Replication Policy (PRP). Passwords are the only part of the Domain partition of the Active Directory (AD) database that is selectively replicated to RoDC's. All the rest of the objects and attributes will be replicated. PRP is based on ...


2

It's a long shot but I'd try: it seems to me some incompatibility between win7 and samba-based RODC in terms of security level settings. I'd also assume some default security setting on win 7 is too restrictive that samba doesn't support. I will try to relax security settings on win 7 by change local policy: Computer Configuration->Windows Settings->Security ...


2


1

You can temporarily jump back by adding a routable interface to the IPSpace- then you could join the domain and then remove that interface from the IPSpace.


1

RODC's are really the only recommended option for branch office authentication, for security reasons. You can also include them in their own site. I would recommend also configuring credential caching on the RODC. http://technet.microsoft.com/en-us/library/cc732801%28v=WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc771744%28WS.10%29.aspx


1

My attitude would be that if you do decide based on your own research and knowledge about your WAN link reliability, etc. to sync those RODCs with a reliable external time source that you would sync them to the SAME external NTP source that the PDC Emulator is currently using. This would help ensure that there isn't any discrepancies based on any external ...


1

Take a look into converting from FRS to DFS-R replication. Along the way you'll probably figure out what's going on and why things are taking so long, and move away from the now deprecated FRS sysvol replication. Here's the article from Microsoft outlining the process: http://technet.microsoft.com/en-us/library/dd640019(v=ws.10).aspx In particular you can ...


1

You haven't been clear about what you've done. I would suggest you run adprep /rodcprep (or confirm you did. You should be able to run it again to verify it's been done. And for good measure, carefully review the TechNet article Steps for Deploying an RODC and make sure you didn't miss something.


1

This is certainly a product suggestion and will likely be closed. In any case, have a look at the Riverbed Steelhead devices. Not only do they provide a SIGNIFICANT improvement in WAN performance but you can add a full install of Windows to the appliance at the branch office to run as your RODC as well as provide other local services. Very simple to ...


1

Did you go through the prereqs for an RODC available here: http://technet.microsoft.com/en-us/library/cc731243%28WS.10%29.aspx You must: Run adprep /rodcprep in order to extend your schema. This is more than the typical domainprep and forestprpe Be running your forest is running at 2003 level or higher Have at least 1 writable DC running Windows Server ...



Only top voted, non community-wiki answers of a minimum length are eligible