cached the passwords for those accounts. For example, an administrator can specify in advance any accounts that an RODC will need to cache. This way, the RODC can authenticate those accounts (once their credentials have been cached), even if the WAN link to the hub site is offline. Administrator role separation The local administrator role of an RODC can be delegated to any domain user without granting that user any user rights for the domain or other domain controllers. This permits a local branch user to log on to an RODC and perform maintenance work on the server, such as upgrading a driver. However, the user in the branch office cannot log on to any other domain controller or perform any other administrative tasks in the domain. In this way, the user in the branch office can be delegated the ability to effectively manage the RODC in the branch office without compromising the security of the rest of the domain. Administration role separation provides a flexible administration model while enhancing security, especially in branch offices where some local control or maintenance may be needed but the central network and servers must be protected. New MMC snap-in functions The Active Directory and Services snap-in in Windows Server 2008 includes a Find command on the toolbar and on the Action menu. This command helps to find the site in which a domain controller is placed; this can help with troubleshooting replication problems between domain controllers in branches and hubs. To help manage RODCs, there is now a Password Replication Policy tab on the domain controller Properties sheet. An administrator can click the Advanced button on this tab to see what: passwords have been sent to the RODC passwords are currently stored on the RODC accounts have authenticated to the RODC, including accounts that are not currently defined in the security groups that are allowed or denied replication—the administrator can see who is using the RODC and can determine whether to allow or deny password replication Read-only Domain Name System The Domain Name System (DNS) Server service can be installed on an RODC. An RODC is able to replicate all application directory partitions that DNS uses, including ForestDNSZones and DomainDNSZones. If the DNS server is installed on an RODC, clients can query it for name resolution as they would query any other DNS server. This allows
cached the passwords for those accounts. For example, an administrator can specify in advance any accounts that an RODC will need to cache. This way, the RODC can authenticate those accounts (once their credentials have been cached), even if the WAN link to the hub site is offline. Administrator role separation The local administrator role of an RODC can be delegated to any domain user without granting that user any user rights for the domain or other domain controllers. This permits a local branch user to log on to an RODC and perform maintenance work on the server, such as upgrading a driver. However, the user in the branch office cannot log on to any other domain controller or perform any other administrative tasks in the domain. In this way, the user in the branch office can be delegated the ability to effectively manage the RODC in the branch office without compromising the security of the rest of the domain. Administration role separation provides a flexible administration model while enhancing security, especially in branch offices where some local control or maintenance may be needed but the central network and servers must be protected. New MMC snap-in functions The Active Directory and Services snap-in in Windows Server 2008 includes a Find command on the toolbar and on the Action menu. This command helps to find the site in which a domain controller is placed; this can help with troubleshooting replication problems between domain controllers in branches and hubs. To help manage RODCs, there is now a Password Replication Policy tab on the domain controller Properties sheet. An administrator can click the Advanced button on this tab to see what: passwords have been sent to the RODC passwords are currently stored on the RODC accounts have authenticated to the RODC, including accounts that are not currently defined in the security groups that are allowed or denied replication—the administrator can see who is using the RODC and can determine whether to allow or deny password replication Read-only Domain Name System The Domain Name System (DNS) Server service can be installed on an RODC. An RODC is able to replicate all application directory partitions that DNS uses, including ForestDNSZones and DomainDNSZones. If the DNS server is installed on an RODC, clients can query it for name resolution as they would query any other DNS server. This allows
WS08TechnicalOverviewFinal_En.docx