Why Read-only domain controllers (RODC) ?

In enterprise level network its common to have HQ(Head Quarters)-Branch Office network. These branch offices may required  to connected with HQ resources for its operations. Most of the time this kind of setup uses WAN links to connect branch  Offices with HQ network. Let's assume we have company called ABC and its HQ is located in Canada Toronto. Due to the  Expansion its need branch office open in London, UK. So the requirement is more complicated as its 2 different countries. 
The users in London office still need to authenticate the company domain environment and access the resources. Let's Look in 
to some of the difficulties, challenges faces with typical this kind of setup.

Lack of Resources

To connect HQ with branch site its required secure, reliable connection. But these connections typically comes with high $$$$ cost. Even though its cost mostly these links will be with speed of 128kb, 256kb, 512kb etc. If users in branch site is authenticating company AD it will use WAN link for the all the authentication, resources access etc. if the number of  users increase in branch site the link utilization just for the AD activities will increased. Also since its between  different geographical locations, different ISP, many facts will affect the reliability of the link as well. what happen if  the WAN link went down on critical business day ? so solution is to deploy AD in branch site and it will be opening whole different range of concerns, problems.

Security Risks

Even though branch office dc will increase the authentication and resource access process its open potential security  risks to the network. some companies will have fully secure datacenter facilities in branch sites as well but majority  cant afford such investments. As we know regular DC is keeping critical data about users, resource authentications etc.  what if these branch office dc get compromised or stolen?. It will affect entire company network operations and some time  this kind of issue can cause millions of dollars lost to the company.

Management

If we host a branch site DC, typically it will required maintenance time to time. it may be to deploy fail over dc, upgrade hardware, site-link changes, user credential changes etc. So some time company may need to keep a IT department  running on branch office which will increase the company operation cost. Also since its integrated directly with main  domain environment, any changes triggers in branch office DC will also directly affect entire domain environment.

So what is the answer then ?

With windows 2008 server Microsoft introduce the Read-Only domain controller feature to specially address these  difficulties company face in this kind of branch site scenario.

Read-Only!!!!

As its name says its by default Read-only copy of the company main DC. So the changes making on branch site RODC will not  affect DC operations. So basically its keep all the info about the DC attributes in Branch-DC as read-only copy and once  its receive request for authentication it directs the request to the RODC instead going via WAN link.

Password Replication Policy (PRP)

We can also control this "credential caching" in detail level by using Password Replication Policy. what it does is we can  define which users, group need the credential caching on that particular RODC. For example let's assume we have another  branch in India. The users in India office will not login from London office anyway. so why we should cache credential info  for India office users in London office RODC ? Also in this way it improve security of dc more. So if one of branch office  RODC compromised it will only hold limited data about the DC.

In windows 2012 server to configure we can use 2 security groups it creates with RODC setup. According to Microsoft its as  following,

Allowed RODC Password Replication Group : Members of this group are placed in the Allow list of the Password Replication  Policies of all RODCs by default. This group has no members when Windows Server 2012 is first installed.

Denied RODC Password Replication Group: Members of this group are placed in the Deny list of the Password Replication  Policies of all RODCs by default. Some of the groups include Administrators, Server Operators, Backup Operators, Account  Operators, and Denied RODC Password Replication Group.

Local Administrators Group

Some time the branch offices need some IT support for their users. It may have local IT staff or outsourced IT company for this. In typical DC environment to do the maintenance a particular user need to have domain admin rights or delegated permissions. But in RODC we can define Local administrator accounts which will give full control over the RODC environment and it still will not affect the parent DC setup.

In next post will look in to the configuration of a RODC.