4. Password Replication Policy
Password Replication Policy (PRP) determines which
users’ credentials can be cached on a specific RODC. If PRP allows an
RODC to cache a user’s credentials, authentication and service ticket
activities of that user can be processed by the RODC. If a user’s
credentials cannot be cached on an RODC, authentication and service
ticket activities are referred by the RODC to a writable domain
controller.
An RODC’s PRP is determined by two multivalued attributes of the
RODC’s computer account. These attributes are commonly known as the
Allowed List and the Denied
List. If a user’s account is on the Allowed List, the
user’s credentials are cached. You can include groups on the Allowed
List, in which case all users who belong to the group can have their
credentials cached on the RODC. If the user is on both the Allowed
List and the Denied List, the user’s credentials will not be
cached—the Denied List takes precedence.
Configuring Domain-Wide Password Replication Policy
To facilitate the management of PRP, Windows Server 2008 R2
creates two domain local security groups in the Users container of
Active Directory. The first group, Allowed RODC Password Replication Group, is added to
the Allowed List of each new RODC. By default, the group has no
members. Therefore, by default, a new RODC will not cache any user’s
credentials. If you have users whose credentials you want to be
cached by all domain RODCs, add those users to the Allowed RODC Password Replication Group.
The second group is named Denied RODC Password Replication Group. It is added to
the Denied List of each new RODC. If you have users whose
credentials you want to ensure are never cached by domain RODCs, add
those users to the Denied RODC Password Replication Group. By
default, this group contains groups for security-sensitive accounts
including Domain Admins, Enterprise Admins, and Group Policy Creator
Owners.
Note
COMPUTERS ARE PEOPLE,
TOO
Remember that it is not only users that generate
authentication and service ticket activity. Computers in a branch
office also require such activity. To improve performance of
systems in a branch office, allow the branch RODC to cache
appropriate computer credentials as well.
Configuring RODC-Specific Password Replication Policy
The two groups described in the previous section provide a
method to manage PRP on all RODCs. However, to best support a branch
office scenario, you must allow the RODC in each branch office to
cache credentials of users and computers in that specific location.
Therefore, you must configure the Allowed List and the Denied List of each
RODC.
To configure an RODC’s PRP, open the properties of the RODC’s
computer account in the Domain Controllers OU. On the Password Replication Policy tab, shown in Figure 4, you can view
the current PRP settings and add or remove users or groups from the
PRP.
5. Administering RODC Credentials Caching
When you click the Advanced button on the Password Replication
Policy tab shown in Figure 4, an Advanced
Password Replication Policy dialog box appears. An example is shown in
Figure 5.
In the drop-down list at the top of the Policy Usage tab, you
can select one of two reports for the RODC:
-
Accounts Whose Passwords Are Stored On
This Read-Only Domain Controller Displays the list of
user and computer credentials that are currently cached on the
RODC. Use this list to determine whether credentials are being
cached that you do not want cached on the RODC. Then modify the
PRP accordingly. -
Accounts That Have Been Authenticated
To This Read-Only Domain Controller Displays the list of
user and computer credentials that have been referred to a
writable domain controller for authentication or service ticket
processing. Use this list to identify users or computers that are
attempting to authenticate with the RODC. If any of these accounts
are not being cached, consider adding them to the PRP.
In the same dialog box, you can use the Resultant Policy tab to
evaluate the effective caching policy for an individual user or
computer. Click Add to select a user or computer account for
evaluation.
Under normal circumstances, if a user or computer is on the
Allowed List of an RODC, the account credentials can be cached on the
RODC but will not be cached until the authentication or service ticket
events cause the RODC to replicate the credentials from a writable
domain controller. However, you can also use the Advanced Password
Replication Policy dialog box to prepopulate user and computer
credentials in the RODC cache. This ensures that authentication and service
ticket activity will be processed locally by the RODC even when the user or computer is authenticating
for the first time. To prepopulate credentials, click Prepopulate
Passwords and select the appropriate users and computers.
6. Administrative Role Separation
RODCs in branch offices can require maintenance such as
an updated device driver. Additionally, small branch offices might
combine the RODC role with the file server role on a single system, in
which case it is important to be able to back up the system. RODCs
support local administration through a feature called
administrative role separation. Each RODC
maintains a local database of groups for specific administrative
purposes. You can add domain user accounts to these local roles to
enable support of a specific RODC.
You can configure administrative role separation by using the
Dsmgmt.exe command. To add a user to the Administrators
role on an RODC, follow these steps:
-
Open Command Prompt on the RODC. -
Type dsmgmt and press
Enter. -
Type local roles and press
Enter.
At the Local Roles prompt, you can type ? and press Enter for a list of commands.
You can also type list roles and
press Enter for a list of local roles. -
Type add username
administrators, where username is
the pre–Windows 2000 logon name of a domain user, and press
Enter.
You can repeat this process to add other users to the various
local roles on an RODC.
Practice Configuring Read-Only Domain Controllers
Practice Configuring Read-Only Domain Controllers
In this practice, you implement read-only domain controllers
in a simulation of a branch office scenario. You install an RODC,
configure password replication policy, monitor credential caching,
and prepopulate credentials on the RODC. To perform this practice,
you must complete the following preparatory tasks:
-
Install a second server running a full installation of
Windows Server 2008 R2. Name the server BRANCHSERVER. Do not
join the computer to the domain. Set the server’s IP
configuration as follows:
-
IP Address: 10.0.0.12 -
Subnet Mask: 255.255.255.0 -
Default Gateway: 10.0.0.1 -
DNS Server: 10.0.0.11 (the address of
SERVER01)
-
Create the following Active Directory objects:
-
A global security group named Branch Office
Users -
A user named James Fine, who is a member of Branch
Office Users -
A user named Adam Carter, who is a member of Branch
Office Users -
A user named Mike Danseglio, who is
not a member of Branch Office
Users
In this and other practices in this training kit, you will
log on to the domain controller with user accounts that are not a
member of Domain Administrators or the domain’s Administrators
group. Therefore, you must give all user accounts the right to log
on locally to the domain controllers in your practice environment.
Follow the steps in the article, “Grant a Member the Right to
Logon Locally,” at
http://technet.microsoft.com/en-us/library/ee957044(WS.10).aspx to
grant the Allow Logon Locally right to the Administrators and
Domain Users groups. If you will use Remote Desktop Services to
connect to the domain controller—rather than logging on
locally—grant the Allow Logon Through Remote Desktop Services
right. Reboot the server or otherwise refresh Group Policy. This
is for the practice environment only. In a production environment,
you should not grant users the right to log on to domain
controllers.
EXERCISE 1 Install an
RODC
In this exercise, you configure the BRANCHSERVER server as
an RODC in the contoso.com domain.
-
Log on to BRANCHSERVER as Administrator. -
Click Start, and then click Run. -
Type dcpromo and click
OK.
A window appears, informing you that the Active
Directory Domain Services binaries are being installed. When
installation is complete, the Active Directory Domain Services
Installation Wizard appears. -
On the first page of the wizard, click Next. -
On the Operating System Compatibility page, click
Next. -
On the Choose A Deployment Configuration page, click
Existing Forest, and then click Add A Domain Controller To An
Existing Domain. Click Next. -
On the Network Credentials page, type contoso.com. -
Click Set. -
In the User Name box, type CONTOSO\Administrator. -
In the Password box, type the password for the domain’s
Administrator account. Click OK, and then click Next. -
On the Select A Domain page, select contoso.com and
click Next. -
On the Select A Site page, select
Default-First-Site-Name and click Next.
In a production environment, you would select the site
for the branch office in which the RODC is being installed.
-
On the Additional Domain Controller Options page, select
Read-Only Domain Controller (RODC). Also ensure
that DNS Server and Global Catalog are selected. Then click
Next. -
On the Delegation Of RODC Installation And
Administration page, click Next. -
On the Location For Database, Log Files, And SYSVOL
page, click Next. -
On the Directory Services Restore Mode Administrator
Password page, type a password in the Password and Confirm
Password boxes, and then click Next. -
On the Summary page, click Next. -
In the progress window, select the Reboot On Completion
check box.
EXERCISE 2 Configure Password
Replication Policy
In this exercise, you configure PRP at the domain level and
for an individual RODC. PRP determines whether the credentials of
a user or computer are cached on an RODC.
-
Log on to SERVER01 as Administrator. -
Open the Active Directory Users And Computers snap-in,
expand the domain, and select the Users container. -
Examine the default membership of the Allowed RODC
Password Replication Group. -
Open the properties of the Denied RODC Password
Replication Group. -
Add the DNSAdmins group as a member of the Denied RODC
Password Replication Group. Click OK to close the group
Properties dialog box. -
Select the Domain Controllers OU. -
Open the properties of BRANCHSERVER. -
On the Password Replication Policy tab, identify the PRP
settings for the two groups: Allowed RODC Password Replication
Group and Denied RODC Password Replication Group. -
Click Add. -
Select Allow Passwords For The Account To Replicate To
This RODC and click OK. -
In the Select Users, Computers, Or Groups dialog box,
type Branch Office Users and
click OK, and then click OK again.
EXERCISE 3 Monitor Credential
Caching
In this exercise, you simulate the logon of several users to
the branch office server and evaluate the credentials caching of
the server.
-
Log on to BRANCHSERVER as James Fine, and then log
off. -
Log on to BRANCHSERVER as Mike Danseglio, and then log
off. -
Log on to SERVER01 as Administrator and open the Active
Directory Users And Computers snap-in. -
Open the properties of BRANCHSERVER in the Domain
Controllers OU. -
On the Password Replication Policy tab, click
Advanced. -
On the Policy Usage tab, in the Display Users And
Computers That Meet The Following Criteria drop-down list,
select Accounts Whose Passwords Are Stored On This Read-Only Domain Controller. -
Locate the entry for James Fine.
Because you had configured the PRP to allow caching of
credentials for users in the Branch Office Users group, James
Fine’s credentials were cached when he logged on in step 1.
Mike Danseglio’s credentials are not cached. -
In the drop-down list, select Accounts That Have Been
Authenticated To This Read-Only Domain Controller. -
Locate the entries for James Fine and Mike
Danseglio. -
Click Close, and then click OK.
EXERCISE 4 Prepopulate Credentials
Caching
In this exercise, you prepopulate the cache of the RODC with
the credentials of a user.
-
Log on to SERVER01 as Administrator and open the Active
Directory Users And Computers snap-in. -
Open the properties of BRANCHSERVER in the Domain
Controllers OU. -
On the Password Replication Policy tab, click
Advanced. -
Click Prepopulate Passwords. -
Type Adam Carter and
click OK. -
Click Yes to confirm that you want to send the
credentials to the RODC. A dialog box informs you that the
action was successful. Click OK. -
On the Policy Usage tab, select Accounts Whose Passwords
Are Stored On This Read-Only Domain Controller. -
Locate the entry for Adam Carter.
Adam’s credentials are now cached on the RODC. -
Click Close, and then click OK.
|
