In one of my earlier posts, I showed you to deploy Windows Server 2016 read-only domain controller using server manager. However, if you are using Window Server 2016 core version you only have the option to use PowerShell.
In this article, I have compiled six useful PowerShell cmdlets which can help you to install, configure and manage an RODC on Server 2016 core version.
- Promoting a server to an RODC
Install-ADDSDomainController -Credential (Get-Credential) -DomainName <domainName> -InstallDNS:$true -ReadOnlyReplica:$true -SiteName "<SiteName>" -Force:$true
- Getting a list of Denied RODC Replication Group members
Get-ADGroupMember -Identity "Denied RODC Password Replication Group" | ft DistinguishedName, Name, ObjectClass
- Adding user accounts to the Allowed Password Replication Group
Add-ADGroupMember -Identity 'Allowed RODC Password Replication Group' -Members <membername> -Confirm:$false
- Getting a list of Allowed RODC Replication Group members
Get-ADGroupMember -Identity "Allowed RODC Password Replication Group" | ft DistinguishedName, Name, ObjectClass
- Prepopulating user passwords
Sync-ADObject -Source <WriteableDC> ‑Destination <Read-OnlyDC> -PasswordOnly
- Getting the list of accounts with passwords stored on the RODC
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity "<Read-OnlyDc>" ‑RevealedAccounts | ft Name,ObjectClass