6 Useful PowerShell cmdlets for Windows Server 2016 Read-Only Domain Controller (RODC)

In one of my earlier posts, I showed you to deploy Windows Server 2016 read-only domain controller using server manager. However, if you are using Window Server 2016 core version you only have the option to use PowerShell.

In this article, I have compiled six useful PowerShell cmdlets which can help you to install, configure and manage an RODC on Server 2016 core version.

1. Promoting a server to an RODC
   
   Install-ADDSDomainController -Credential (Get-Credential) -DomainName <domainName> -InstallDNS:$true -ReadOnlyReplica:$true -SiteName "<SiteName>" -Force:$true
2. Getting a list of Denied RODC Replication Group members
   
   Get-ADGroupMember -Identity "Denied RODC Password Replication Group" | ft DistinguishedName, Name, ObjectClass
3. Adding user accounts to the Allowed Password Replication Group
   
   Add-ADGroupMember -Identity 'Allowed RODC Password Replication Group' -Members <membername> -Confirm:$false
4. Getting a list of Allowed RODC Replication Group members
   
   Get-ADGroupMember -Identity "Allowed RODC Password Replication Group" | ft DistinguishedName, Name, ObjectClass
5. Prepopulating user passwords
   
   Sync-ADObject -Source <WriteableDC> ‑Destination <Read-OnlyDC> -PasswordOnly
6. Getting the list of accounts with passwords stored on the RODC
   
   Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity "<Read-OnlyDc>" ‑RevealedAccounts | ft Name,ObjectClass

Click here to learn more about these Powershell cmdlets and how to use them to deploy Windows Server 2016 read-only domain controller in your environment.