You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The **Add-ADDSReadOnlyDomainControllerAccount** cmdlet creates a read-only domain controller (RODC) account that can be used to install an RODC in Active Directory.
28
+
29
+
The `Add-ADDSReadOnlyDomainControllerAccount` cmdlet creates a read-only domain controller (RODC)
30
+
account that can be used to install an RODC in Active Directory.
This command adds a RODC account to the corp.contoso.com domain using the North America site as the source site for the replication source domain controller.
45
+
This command adds a RODC account to the `corp.contoso.com` domain using the North America site as the
46
+
source site for the replication source domain controller.
37
47
38
48
## PARAMETERS
39
49
40
50
### -AllowPasswordReplicationAccountName
41
-
Specifies an array of user accounts, group accounts, and computer accounts whose passwords can be replicated to this RODC.
42
-
Use None if you want to keep the value empty.
43
-
By default, only the Allowed RODC Password Replication Group is allowed, and it is originally created empty.
51
+
52
+
Specifies an array of user accounts, group accounts, and computer accounts whose passwords can be
53
+
replicated to this RODC. Use None if you want to keep the value empty. By default, only the Allowed
54
+
RODC Password Replication Group is allowed, and it is originally created empty.
Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not to be replicated to this RODC.
105
-
Use None if you do not want to deny the replication of credentials of any users or computers.
106
-
By default, Administrators, Server Operators, Backup Operators, Account Operators, and the Denied RODC Password Replication Group are denied.
107
-
By default, the Denied RODC Password Replication Group includes Cert Publishers, Domain Admins, Enterprise Admins, Enterprise Domain Controllers, Enterprise Read-Only Domain Controllers, Group Policy Creator Owners, the krbtgt account, and Schema Admins.
119
+
120
+
Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not
121
+
to be replicated to this RODC. Use None if you do not want to deny the replication of credentials of
122
+
any users or computers. By default, Administrators, Server Operators, Backup Operators, Account
123
+
Operators, and the Denied RODC Password Replication Group are denied. By default, the Denied RODC
124
+
Password Replication Group includes Cert Publishers, Domain Admins, Enterprise Admins, Enterprise
125
+
Domain Controllers, Enterprise Read-Only Domain Controllers, Group Policy Creator Owners, the krbtgt
Indicates that the cmdlet executes only a base set of validations.
231
-
This behavior is equivalent to the validations that were performed when using Dcpromo.exe in earlier versions of Windows Server to add a domain controller.
232
-
When this switch parameter is set, it specifies that additional preliminary checks should be bypassed.
233
-
For more information on the scope of these additional preliminary checks that the ADDSDeployment module performs by default when using Windows Server 2012, refer to the table in the section ADPrep and Prerequisite Checking Architecture in [AD DS Simplified Administration](https://go.microsoft.com/fwlink/?LinkID=237244).
256
+
257
+
Indicates that the cmdlet executes only a base set of validations. This behavior is equivalent to
258
+
the validations that were performed when using `Dcpromo.exe` in earlier versions of Windows Server
259
+
to add a domain controller. When this switch parameter is set, it specifies that additional
260
+
preliminary checks should be bypassed. For more information on the scope of these additional
261
+
preliminary checks that the **ADDSDeployment** module performs by default when using Windows Server
262
+
2012, refer to the table in the section ADPrep and Prerequisite Checking Architecture in
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
295
+
296
+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
* Once you have added the RODC account, you can add an RODC to a server computer by using the **Install-ADDSDomainController** cmdlet with the *ReadOnlyReplica* switch parameter.
272
-
* You can also delegate the ability to attach the server to a non-administrative group or user. If you are deploying RODCs in delegated administration scenarios where the machine accounts are pre-provisioned, creating the RODC account is the first stage of the RODC installation process and needs to be done by a member of the Domain Admins group. In these scenarios, once an administrator uses this cmdlet to add the RODC account in Active Directory Domain Services (AD DS), the second stage of the installation can occur. This involves attaching an actual server computer in a remote location (such as a branch office) that will operate as the RODC for the specified account created using this cmdlet.
306
+
307
+
- Once you have added the RODC account, you can add an RODC to a server computer by using the
308
+
`Install-ADDSDomainController`cmdlet with the `-ReadOnlyReplica` switch parameter.
309
+
- You can also delegate the ability to attach the server to a non-administrative group or user. If
310
+
you are deploying RODCs in delegated administration scenarios where the machine accounts are
311
+
pre-provisioned, creating the RODC account is the first stage of the RODC installation process and
312
+
needs to be done by a member of the Domain Admins group. In these scenarios, once an administrator
313
+
uses this cmdlet to add the RODC account in Active Directory Domain Services (AD DS), the second
314
+
stage of the installation can occur. This involves attaching an actual server computer in a remote
315
+
location (such as a branch office) that will operate as the RODC for the specified account created
316
+
using this cmdlet.
273
317
274
318
## RELATED LINKS
275
319
@@ -278,4 +322,3 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
0 commit comments