Can you make an Active Directory (AD) domain controller (DC) read-only?

A. The DCs in an AD domain all contain a writable copy of their local domain partition; therefore you can't configure them as read-only as you could with a NT 4.0 BDC. DCs that are Global Catalog (GC)servers do contain read-only subsets of information about all other domains in the forest, but that's as far as read-only DCs is possible