Authentication in VS .NET

Create Code128 in VS .NET Authentication

8

to Active Directory from DCs in the hub site. Replication is one way (from a writable domain controller to a RODC); no changes to the RODC are replicated to any other domain controller. This eliminates the exposure of the directory service to corruption resulting from changes made to a compromised branch office DC. Finally, RODCs, unlike writable DCs, have a local Administrators group. You can give one or more local support personnel the ability to maintain an RODC fully, without granting them the equivalence of domain administrators.

Hub Site (Headquarters/Central site)

Branch Sites (Physically Less Secure)

Figure 8-7

The high-level steps to install an RODC are as follows: 1. Ensure that the forest functional level is Windows Server 2003 or higher. 2. If the forest has any DCs running Microsoft Windows Server 2003, run Adprep /rodcprep. 3. Ensure that at least one writable DC is running Windows Server 2008. 4. Install the RODC. Each of these steps is detailed in the following sections.

Functional levels enable features unique to specific versions of Windows and are, therefore, dependent on the versions of Windows running on domain controllers. If all domain controllers are Windows Server 2003 or later, the domain functional level can be set to Windows Server 2003. If all domains are at Windows Server 2003 domain functional level, the forest functional level can be set to Windows Server 2003. Domain and forest functional levels are discussed in detail in 12. RODCs require that the forest functional level is Windows Server 2003 or higher. That means that all domain controllers in the entire forest are running Windows Server 2003 or later. To determine the functional level of your forest, open Active Directory Domains And Trusts from the Administrative Tools folder, right-click the name of the forest, choose Properties, and verify the forest functional level, as shown in Figure 8-8. Any user can verify the forest functional level in this way. If the forest functional level is not at least Windows Server 2003, examine the properties of each domain to identify any domains for which the domain functional level is not at least Windows Server 2003. If you find such a domain, you must ensure that all domain controllers in the domain are running Windows Server 2003. Then, in Active Directory Domains And Trusts, right-click the domain and choose Raise Domain Functional Level. After you have raised each domain functional level to at least Windows Server 2003, right-click the root node of the Active Directory Domains And Trusts snap-in and choose Raise Forest Functional Level. In the Select An Available Forest Functional Level drop-down list, choose Windows Server 2003 and click Raise. You must be an administrator of a domain to raise the domain s functional level. To raise the forest functional level, you must be either a member of the Domain Admins group in the forest root domain or a member of the Enterprise Admins group.

8

Figure 8-8

If you are upgrading an existing forest to include domain controllers running Windows Server 2008, you must run Adprep /rodcprep. This command configures permissions so that RODCs are able to replicate DNS application directory partitions. DNS application directory partitions are discussed in 9, Integrating Domain Name System with AD DS. If you are creating a new Active Directory forest and it will have only domain controllers running Windows Server 2008, you do not need to run Adprep /rodcprep. You can find this command in the cdrom\Sources\Adprep folder of the Windows Server 2008 installation DVD. Copy the folder to the domain controller acting as the schema master. The schema master role is discussed in 10, Domain Controllers. Log on to the schema master as a member of the Enterprise Admins group, open a command prompt, change directories to the Adprep folder, and type adprep /rodcprep.