Windows Server 2008 Beta3: Can and RODC be a GC?

Answer: Yes.

If you're looking to deploy some RODCs during the B3 timeframe then it would be a good idea to read through this first:

Step-by-Step Guide for Read-Only Domain Controller in Windows Server 2008 Beta 3

One of the gotchas before an RODC will advertise as a GC in your domain is that domainprep needs to be run in each domain, regardless if there are Win2k8 DCs in the domain or not:

If the RODC will be a global catalog server, you must also run adprep /domainprep in all domains in the forest, regardless of whether the domain runs a Windows Server 2008 domain controller. When you run adprep /domainprep in all domains, the RODC can replicate global catalog data from all domains in the forest and then advertise as a global catalog server.

If you haven't looked at RODCs for your branch office deployments for the future now is a good time to do so.  I think one of the best things coming for Win2k8 is the ability to run RODCs on Server Core, reducing the attack surface and patching requirements and only caching the passwords for the users needed in the branch site instead of all passwords for the domain.

The step-by-step guide I pointed out above has a plethora of info on RODCs, what they can do, and how to set them up, and how to take advantage of their new features.  Do yourself a favor and read it/reference it, if your a DS Admin.

Comments (0)

Skip to main content