RODCs, FSMO roles and AD DS partitions
Domain controllers are the heart of Active Directory Domain Services (AD DS). The exam asks how to place them safely, which roles to move, and how replication scope is controlled.
Read-only domain controllers
An RODC holds a read-only copy of the AD DS database and does not replicate changes outward. Use it in branches with weak physical security.
- The Password Replication Policy (PRP) lists which accounts may be cached. The groups Allowed RODC Password Replication Group and Denied RODC Password Replication Group control this.
- A delegated administrator can manage the RODC locally without being a domain admin.
- The filtered attribute set (stored in the schema partition) stops chosen attributes from replicating to RODCs. Mark the attribute as RODC filtered.
- Run
Add-ADDSReadOnlyDomainControllerAccountto pre-stage the account, then promote withInstall-ADDSDomainController -ReadOnlyReplica.
To cut WAN traffic, use Install from Media: run ntdsutil, then activate instance ntds, ifm, create sysvol rodc <path>, and point promotion at that folder with -InstallationMediaPath.
Operations master (FSMO) roles
| Role | Scope | Typical question |
|---|---|---|
| Schema master | Forest | Extend the schema |
| Domain naming master | Forest | Add or remove domains |
| PDC emulator | Domain | Time source, password changes, GPO edits |
| RID master | Domain | Allocates RID pools |
| Infrastructure master | Domain | Cross-domain references |
Transfer roles with Move-ADDirectoryServerOperationMasterRole -Identity DC3 -OperationMasterRole PDCEmulator. Use seize only when the old holder is gone for good.
Application partitions and replication scope
Every DC holds the schema, configuration and domain partitions. Schema and configuration replicate forest-wide; the domain partition replicates within the domain. The built-in DNS partitions (DomainDnsZones, ForestDnsZones) replicate to DCs running DNS.
For finer control, create a custom partition and enrol specific servers:
Add-DnsServerDirectoryPartition -Name "dns.contoso.com"
Register-DnsServerDirectoryPartition -Name "dns.contoso.com" -ComputerName DC2Exam traps
- A schema extension replicates to every DC in the forest; creating a user replicates only within its domain.
- Moving the PDC emulator for time means the one in the forest root domain.
- The infrastructure master must not sit on a global catalog server unless every DC is a global catalog.
- A PRP caches passwords, but an RODC never lets a stolen copy change AD DS.
- An RODC cannot be the only DC for a domain; a writable DC is required.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A branch office has poor physical security. If its domain controller is stolen, attackers must not obtain the passwords of all users. What do you deploy?
Show answer
Answer: B.An RODC caches only the credentials allowed by its Password Replication Policy, so a theft exposes few accounts.
2. You must make DC3 the authoritative time source for the whole forest. Which role must DC3 hold?
Show answer
Answer: C.Time sync flows from the PDC emulator of the forest root domain. Move it with Move-ADDirectoryServerOperationMasterRole.
3. A DNS zone must replicate to only four chosen domain controllers. What do you create?
Show answer
Answer: B.A custom application partition (created with Add-DnsServerDirectoryPartition) replicates only to DCs enrolled in it.
4. You promote an RODC in a branch with a slow WAN link and want to minimise network traffic. What should you use?
Show answer
Answer: A.IFM media (made with ntdsutil "ifm" and "create sysvol rodc") seeds the database locally, so only changes cross the WAN.