I currently have a lab running that contains a RWDC, a RODC and a Client PC. Both Domain Controllers are running W2K8 R2.
The RODC currently functions as a LAN Router, VPN Server, IIS Server and Certificate Authority. The RWDC is only running ADDS. The problem I am having is that although the the second Domain Controller is a RODC I can still create user accounts via 'Active Directory Users and Computers' on the RODC.
The account I am using to create these users is the domain admin account. I read online that the fact that I can still create AD objects is related to the DNS referral system. Not sure on what that does or means though.
Can anyone shed some light on the situation?