In this Screencast, we will demonstrate the installation of a Windows Server 2008 Read Only Domain Controller (RODC). Before you proceed with the installation of an RODC in your network, you have to make sure that it covers certain requirements. Here is a brief overview:

– PDC Emulator – the DC holding the PDC FSMO in the domain where you intend to install RODC must be running Windows Server 2008.

– Global Catalog – you need to have a GC running Windows Server 2008.

– Domain Functional Level must be at least Windows Server 2003

– Forest Functional Level must be at least Windows Server 2003

– Schema modification – you must run once in the forest adprep /rodcprep

In addition, you must have in mind the following:

– Global Catalog – if there are Outlook clients in the branch office, the RODC should be configured as GC.

– Authentication Requests – the RODC forwards authentication requests to a Global Catalog, running Windows Server 2008, in a site that is closest to the site with the RODC.

– Multiple RODCs – RODCs in the same site DO NOT SHARE information with each other. If the connection to a writable DC is down, there could be inconsistent logon experiences for the users.

We will cover the administration of a RODC in a separate Screencast.

In the following step-by-step video-tutorial, we demonstrate the installation of RODC.

Step 1 We will start by creating a new site in Active Directory Sites and Services snap-in. Then, we add the subnet of the remote office to the newly created site; and finally, we will check the Active Directory replication settings between the sites.

Step 2 We take a look at the new NTDTSUtil and the IFM command which comes with it. Then, we run the IFM command which creates a Volume Shadow Copy Service Snapshot of the volume(s) that contain the Active Directory DIT, logs, and SYSVOL, and prepares the IFM media. Finally, we check the created media.

Step 3 In this step, we promote the new Server Core DC in the remote office using IFM.

Step 4 We check the result of the promotion (using NLTES, LDP etc). Also, we demonstrate how to force a replication of AD changes from the main site.