Adding machines to the domain in a Read Only Domain Controller (RODC) site Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) Come Celebrate our 10 Year Anniversary!Useful Command-line Commands on WindowsWhat should I do if a domain controller is stolen?How to set group policy in windows server 2008 domain?Need for another Domain ControllerRestrict network drive to domain users onlyJoin Windows 2003 R2 guest to Windows 2012 R2 domain controllerInternet connectivity with Domain ControllerNew 2012 Domain Controller and error “The security database on the server does not have a computer account for this workstation trust relationship”Domain users cannot change password if domain name is written before usernameCannot join domain despite able to ping to domain to domain controller by domain name and ip
How to say that you spent the night with someone, you were only sleeping and nothing else?
How can I make names more distinctive without making them longer?
Why use gamma over alpha radiation?
Unexpected result with right shift after bitwise negation
Writing Thesis: Copying from published papers
Slither Like a Snake
Why does tar appear to skip file contents when output file is /dev/null?
Who can trigger ship-wide alerts in Star Trek?
Unable to start mainnet node docker container
How do I keep my slimes from escaping their pens?
How many things? AとBがふたつ
Can a non-EU citizen traveling with me come with me through the EU passport line?
Is 1 ppb equal to 1 μg/kg?
Is drag coefficient lowest at zero angle of attack?
Autumning in love
What is the electric potential inside a point charge?
Active filter with series inductor and resistor - do these exist?
Stop battery usage [Ubuntu 18]
Statistical model of ligand substitution
Direct Experience of Meditation
Can I throw a longsword at someone?
grandmas drink with lemon juice
What do you call the holes in a flute?
Was credit for the black hole image misattributed?
Adding machines to the domain in a Read Only Domain Controller (RODC) site
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Useful Command-line Commands on WindowsWhat should I do if a domain controller is stolen?How to set group policy in windows server 2008 domain?Need for another Domain ControllerRestrict network drive to domain users onlyJoin Windows 2003 R2 guest to Windows 2012 R2 domain controllerInternet connectivity with Domain ControllerNew 2012 Domain Controller and error “The security database on the server does not have a computer account for this workstation trust relationship”Domain users cannot change password if domain name is written before usernameCannot join domain despite able to ping to domain to domain controller by domain name and ip
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a site with terrible physical security and a terrible network connection. So I need a domain controller onsite (for when the network connection goes down) but it also needs to be a RODC for security reasons.
The machines onsite in this office have access to other read write domain controllers in other parts of the network. There's no firewall blocking them. I just don't want someone to be able to plug a keyboard / mouse into our domain controller on site and change stuff.
When adding new machines to the domain on this site, do I need to follow the process of creating a computer object in AD and then doing an offline domain join (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10))? Or can I somehow force machines that are currently not part of the domain to go to a RWDC (configured in another AD site) to get added to the domain the normal way?
windows ldap
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I have a site with terrible physical security and a terrible network connection. So I need a domain controller onsite (for when the network connection goes down) but it also needs to be a RODC for security reasons.
The machines onsite in this office have access to other read write domain controllers in other parts of the network. There's no firewall blocking them. I just don't want someone to be able to plug a keyboard / mouse into our domain controller on site and change stuff.
When adding new machines to the domain on this site, do I need to follow the process of creating a computer object in AD and then doing an offline domain join (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10))? Or can I somehow force machines that are currently not part of the domain to go to a RWDC (configured in another AD site) to get added to the domain the normal way?
windows ldap
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44
add a comment |
I have a site with terrible physical security and a terrible network connection. So I need a domain controller onsite (for when the network connection goes down) but it also needs to be a RODC for security reasons.
The machines onsite in this office have access to other read write domain controllers in other parts of the network. There's no firewall blocking them. I just don't want someone to be able to plug a keyboard / mouse into our domain controller on site and change stuff.
When adding new machines to the domain on this site, do I need to follow the process of creating a computer object in AD and then doing an offline domain join (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10))? Or can I somehow force machines that are currently not part of the domain to go to a RWDC (configured in another AD site) to get added to the domain the normal way?
windows ldap
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have a site with terrible physical security and a terrible network connection. So I need a domain controller onsite (for when the network connection goes down) but it also needs to be a RODC for security reasons.
The machines onsite in this office have access to other read write domain controllers in other parts of the network. There's no firewall blocking them. I just don't want someone to be able to plug a keyboard / mouse into our domain controller on site and change stuff.
When adding new machines to the domain on this site, do I need to follow the process of creating a computer object in AD and then doing an offline domain join (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10))? Or can I somehow force machines that are currently not part of the domain to go to a RWDC (configured in another AD site) to get added to the domain the normal way?
windows ldap
windows ldap
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
asked Apr 10 at 0:08
Daniel HoodDaniel Hood
161
161
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Daniel Hood is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44
add a comment |
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44
add a comment |
1 Answer
1
active
oldest
votes
Sadly it seems you will have to create a computer account and then replicate it through your AD domain like what you already found:
https://docs.centrify.com/en/css/2017.3-html/index.html#page/Planning,_preparation,_and_deployment/How_to_join_a_domain_with_a_read-only_domain_con.5.html
There is this script I found that claims it can do it as well:
https://gallery.technet.microsoft.com/Domain-Join-through-an-9a010eb5
Most scripts I find on the TechNet Gallery work like a champ. However since I don't have a RODC I can't test sadly. There might be a way to redirect it to another DC that belongs to another site but if you have strict security compliance that could be a bad thing to do.
Edit
If you were going to try to point it to a different DC I think it would be as simple as configuring the clients DNS to point to a RWDC. Then either through DHCP or manual configuration reset the IP settings especially DNS to the RODC. But again if you have compliance you have to meet this could be frowned upon.
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Daniel Hood is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962334%2fadding-machines-to-the-domain-in-a-read-only-domain-controller-rodc-site%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sadly it seems you will have to create a computer account and then replicate it through your AD domain like what you already found:
https://docs.centrify.com/en/css/2017.3-html/index.html#page/Planning,_preparation,_and_deployment/How_to_join_a_domain_with_a_read-only_domain_con.5.html
There is this script I found that claims it can do it as well:
https://gallery.technet.microsoft.com/Domain-Join-through-an-9a010eb5
Most scripts I find on the TechNet Gallery work like a champ. However since I don't have a RODC I can't test sadly. There might be a way to redirect it to another DC that belongs to another site but if you have strict security compliance that could be a bad thing to do.
Edit
If you were going to try to point it to a different DC I think it would be as simple as configuring the clients DNS to point to a RWDC. Then either through DHCP or manual configuration reset the IP settings especially DNS to the RODC. But again if you have compliance you have to meet this could be frowned upon.
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
add a comment |
Sadly it seems you will have to create a computer account and then replicate it through your AD domain like what you already found:
https://docs.centrify.com/en/css/2017.3-html/index.html#page/Planning,_preparation,_and_deployment/How_to_join_a_domain_with_a_read-only_domain_con.5.html
There is this script I found that claims it can do it as well:
https://gallery.technet.microsoft.com/Domain-Join-through-an-9a010eb5
Most scripts I find on the TechNet Gallery work like a champ. However since I don't have a RODC I can't test sadly. There might be a way to redirect it to another DC that belongs to another site but if you have strict security compliance that could be a bad thing to do.
Edit
If you were going to try to point it to a different DC I think it would be as simple as configuring the clients DNS to point to a RWDC. Then either through DHCP or manual configuration reset the IP settings especially DNS to the RODC. But again if you have compliance you have to meet this could be frowned upon.
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
add a comment |
Sadly it seems you will have to create a computer account and then replicate it through your AD domain like what you already found:
https://docs.centrify.com/en/css/2017.3-html/index.html#page/Planning,_preparation,_and_deployment/How_to_join_a_domain_with_a_read-only_domain_con.5.html
There is this script I found that claims it can do it as well:
https://gallery.technet.microsoft.com/Domain-Join-through-an-9a010eb5
Most scripts I find on the TechNet Gallery work like a champ. However since I don't have a RODC I can't test sadly. There might be a way to redirect it to another DC that belongs to another site but if you have strict security compliance that could be a bad thing to do.
Edit
If you were going to try to point it to a different DC I think it would be as simple as configuring the clients DNS to point to a RWDC. Then either through DHCP or manual configuration reset the IP settings especially DNS to the RODC. But again if you have compliance you have to meet this could be frowned upon.
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
Sadly it seems you will have to create a computer account and then replicate it through your AD domain like what you already found:
https://docs.centrify.com/en/css/2017.3-html/index.html#page/Planning,_preparation,_and_deployment/How_to_join_a_domain_with_a_read-only_domain_con.5.html
There is this script I found that claims it can do it as well:
https://gallery.technet.microsoft.com/Domain-Join-through-an-9a010eb5
Most scripts I find on the TechNet Gallery work like a champ. However since I don't have a RODC I can't test sadly. There might be a way to redirect it to another DC that belongs to another site but if you have strict security compliance that could be a bad thing to do.
Edit
If you were going to try to point it to a different DC I think it would be as simple as configuring the clients DNS to point to a RWDC. Then either through DHCP or manual configuration reset the IP settings especially DNS to the RODC. But again if you have compliance you have to meet this could be frowned upon.
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
edited Apr 10 at 3:09
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
answered Apr 10 at 3:02
Dion PezzimentiDion Pezzimenti
147119
147119
add a comment |
add a comment |
Daniel Hood is a new contributor. Be nice, and check out our Code of Conduct.
Daniel Hood is a new contributor. Be nice, and check out our Code of Conduct.
Daniel Hood is a new contributor. Be nice, and check out our Code of Conduct.
Daniel Hood is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962334%2fadding-machines-to-the-domain-in-a-read-only-domain-controller-rodc-site%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Provided your clients can access the domain controllers at the main site, I believe it should just all work as normal - the clients should be smart enough to locate a RWDC to use for the domain join. Problems may occur if some of the clients aren't running Windows (as per the first link in Dion's answer) or don't have network access to the main site (as per the second link in Dion's answer).
– Harry Johnston
Apr 10 at 4:44