What is a Read-Only Domain Controller (RODC) and when would you enable it?

What is a Read-Only Domain Controller (RODC) and when would you enable it?

• A. Replaces all writable domain controllers
• B. Stores a read-only copy of AD data and is beneficial in remote locations to reduce password exposure and risk
• C. Holds only read-write AD data
• D. Used for DNS only

Answer: (B)

A Read-Only Domain Controller stores a read-only copy of Active Directory data and is designed for use in locations where security and physical protection may be limited. It can authenticate users and computers locally, but it cannot make changes to AD itself. Any updates or writes to the directory must come from writable domain controllers, and those changes replicate to the RODC. This design is beneficial in remote or branch office scenarios because it reduces the risk of credential exposure and tampering. Passwords and other sensitive data aren’t stored locally unless explicitly allowed by a Password Replication Policy, so if the RODC is compromised, attackers can’t modify AD data or easily harvest credentials for broader access. The RODC still participates in authentication by contacting writable DCs as needed, preserving central control while offering local services. The other options aren’t accurate: an RODC does not replace all writable domain controllers, it never writes to AD data (by definition), and while it can run DNS, it is not used solely for DNS.

A Read-Only Domain Controller stores a read-only copy of Active Directory data and is designed for use in locations where security and physical protection may be limited. It can authenticate users and computers locally, but it cannot make changes to AD itself. Any updates or writes to the directory must come from writable domain controllers, and those changes replicate to the RODC.

This design is beneficial in remote or branch office scenarios because it reduces the risk of credential exposure and tampering. Passwords and other sensitive data aren’t stored locally unless explicitly allowed by a Password Replication Policy, so if the RODC is compromised, attackers can’t modify AD data or easily harvest credentials for broader access. The RODC still participates in authentication by contacting writable DCs as needed, preserving central control while offering local services.

The other options aren’t accurate: an RODC does not replace all writable domain controllers, it never writes to AD data (by definition), and while it can run DNS, it is not used solely for DNS.