Good day, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at deploying Read-Only Domain Controllers.
All right, let's take a look at what we're going to cover.
First up, we'll answer the question,
why should we deploy a Read-Only Domain Controller?
And then we'll do a demo of deploying
a Read-Only Domain Controller.
Let's get started.
So why deploy a Read-Only Domain Controller?
Well, as we mentioned previously
each domain controller has a copy
of the entire Active Directory database.
Now, what happens if you can't guarantee
the physical security of your domain controller?
What happens if someone stole the server
that's running your domain controller?
And then they could use that server
to eventually steal the passwords
from the Active Directory database,
including all of the sensitive passwords
like the Domain Admins and Enterprise Admins.
So how can you prevent passwords
from being stored on a domain controller?
Well, you can use a Read-Only Domain Controller.
And as you'd probably expect, one of the big benefits
of using a Read-Only Domain Controller,
is that password replication can be controlled.
And this is done using a password replication policy.
Which we'll take a look at
in the demo at the end of this lesson.
Another advantage of a Read-Only Domain Controller
is that it can be deployed and managed
using an account that is not privileged,
like say, a member of the domain admins group.
And you can deploy a Read-Only Domain Controller
with delegated administration as part of a two-step process.
And we'll take a look at that in the demo.
Now just a quick tip for the exam.
If you are performing the two-step process
to deploy a Read-Only Domain Controller,
the first step involves staging
the Read-Only Domain Controller.
Do not domain join the Read-Only Domain Controller
before deploying Active Directory Domain Services
and promoting it to a domain controller.
All right, let's take a look at the demo.
In the previous lesson, we deployed 2 domain controllers
in our Brisbane office and one in our Perth office.
And now we're concerned about the physical security
of the domain controller at that Perth office.
And we also want to delegate the administration of that server
to someone in that office due to differences in time zones.
So we've gone ahead and decommissioned
the domain controller in the Perth office.
And we're going to go ahead
and deploy a new Read-Only Domain Controller.
And as we mentioned, there are 2 steps in the process.
The first, is you stage
the Read-Only Domain Controller account.
And in the second step,
you promote the Read-Only Domain Controller.
Now you can do this in one step
if you're not delegating the installation.
But we'll take a look at
the full two-step process in this demo.
And we've created a branch admin account,
for the user that will administer
the Read-Only Domain Controller in the Perth office.
And this user account is not a member
of the Domain Admins group.
Let's jump into the demo.
All right, so here we are logged onto
our administrative server, IDM 01.
And we've taken a look at a few of
the Active Directory administration tools
throughout this course so far,
but to stage a Read-Only Domain Controller,
we need to use the Active Directory Administrative Center.
Let's go ahead and launch
the Active Directory Administrative Center.
Then we're going to go ahead and browse into our domain.
And then we're going to go ahead
and select the Domain Controllers node.
And then we'll select the option
to pre-create a Read-Only Domain Controller account.
We're going to select Use Advanced Mode Installation,
just so I can show you some of the additional options
available when you're staging
your Read-Only Domain Controller.
And we're going to go ahead and stage
the domain controller account using my current credentials.
And for the purposes of staging the RODC account,
we need to be a member of the Domain Admins group.
So we'll go ahead and select Next
and then we're going to provide the name
of our new Read-Only Domain Controller.
And then we'll go ahead and select Next.
It'll just verify that computer name.
And then we need to select the Active Directory site
for our new domain controller.
We're deploying it to our Perth office.
So we'll select Next.
We're going to also make this domain controller
a DNS server and a global catalog.
So we'll go ahead and select Next.
And here we can configure the password replication policy.
And by default, a number of sensitive account passwords
are denied replication to Read-Only Domain Controllers.
Including members of administrators,
Enterprise Administrators, and Domain Admins.
We're okay with the defaults for our purposes.
So we're going to go ahead and select Next.
Now we need to decide who we're going to delegate
the administration of this server to.
And we've gone ahead and created a branch admin account
that will be used to manage
this Read-Only Domain Controller.
So we're going to go ahead
and delegate the installation to that account.
And then we can go ahead and select Next.
And then we'll get a brief summary of what we've configured.
We'll go ahead and select Next.
And now we're finished staging
that Read-Only Domain Controller account.
We'll go ahead and select Finish.
Now let's jump over to our new domain controller
and complete the process by promoting that server
as a Read-Only Domain Controller.
All right, so here we are
on our new Read-Only Domain Controller.
I've gone ahead and installed
the Active Directory Domain Services role.
And I've ran the Active Directory Domain
Services Configuration Wizard.
Let's go ahead and get started.
We're adding a new domain controller to an existing domain.
We'll provide the domain name,
and then we'll go ahead and provide
the branch admin credentials
that have been delegated to promote the server
to our Read-Only Domain Controller.
We'll go ahead and select OK.
And then we'll go ahead and select Next.
And we can see that the wizard has detected
that we have an existing
Read-Only Domain Controller account.
We'll just go ahead and use that account
and we'll provide the directory services
restore mode password. Go ahead and select Next.
And I just want to point out that if you needed to,
you can install a Read-Only Domain Controller from media.
But for our purposes, we're just going to replicate
from an existing domain controller.
We'll go ahead and select Next,
accept the defaults for the database location,
log files, and SYSVOL folder,
and then we'll go ahead and select Next.
Let's take a look at the PowerShell script
that we would use to automate this process.
We'll select View Script.
And we can see we're using
the Install-ADDS domain controller PowerShell cmdlet,
and it's got the perimeter to use an existing account.
Let's go ahead and close this, and then we'll select Next.
And then we can go ahead and select Install.
It'll just take a moment to install
and then we'll come back when this is done.
All right, and we can see that the promotion
of the domain controller is finished
and the server is now restarting.
That wraps up our demo.
Now let's do a quick summary
of what we've covered in this lesson.
So what have we covered in this lesson?
It's important to know that Read-Only Domain Controllers
can be used to control the replication
of privileged credentials to the domain controller.
It's also important to know that the installation
and administration of Read-Only Domain Controllers
can be delegated to a non-privileged user account.
And there are 2 steps in the deployment
of a Read-Only Domain Controller.
In the first step, the account is staged.
And then in the second step,
the domain controller account is attached
and the server is promoted to a domain controller.
All right, that concludes this lesson.
Thanks for being with me.
And I hope you found it useful.
And I look forward to seeing you in the next lesson.