Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Wednesday, August 11, 2010

On an RODC, is the GC writable?

The answer is yes.

RODC (Read Only Domain Controller) is Microsoft’s solution to a branch office or other area where the security of the server may be questionable. It contains a read only copy of Active Directory and DNS. Should the server be stolen, only the passwords, if any, that you designate to be cached on that server need to be changed. The TGT (Ticket Granting Ticket) on a RODC is different than the one actually used by the domain. Therefore, a stolen RODC cannot be used to infiltrate a network.

The Global Catalog (GC) contains a subset of all objects in a forest. In a single domain environment, the domain controllers are aware of all objects in Active Directory. You can search for users, computer, printer, etc. The problem lies when you are in a multi-domain environment. The information on objects is not shared between domains. To help mitigate this issue, Domain Controllers can also be Global Catalog servers. The data contained in GCs only contains the attributes that are normally searched for. In a multi-domain environment, it is recommended to make every Domain Controller a Global Catalog server as well.

In respect to the question, the GC will not hold any sensitive data should the RODC be stolen. On a record which domain the objects are stored in.

http://technet.microsoft.com/en-us/library/dd735489(WS.10).aspx

No comments: