IgNiTeD SoUL

Active Directory is Microsoft’s implementation of a directory service. A directory service holds information about resources within the domain. Resources are stored as objects and include users, computers, groups, printers, and more.

In Windows Server 2008, five different server roles support Active Directory:

>Active Directory Domain Services

>Active Directory Certificate Services

>Active Directory Federation Services

>Active Directory Lightweight Directory Services

>Active Directory Rights Management Services

The primary role is Active Directory Domain Services. The other roles add to the capabilities of Active Directory. Objects include users, computers, groups, and more. The Active Directory database is stored only on servers holding the role of domain controllers.

A significant benefit of using Active Directory Domain Services is that it enables you as an administrator to manage desktops, network servers, and applications all from a centralized location.

A read-only domain controller (RODC) hosts a read-only copy of the Active Directory database. This is somewhat of an untrue, because changes can be made to the database. However, the changes can come only from other domain controllers, and the entire database isn’t replicated; instead, only a few select objects are replicated.

Usually, domain controllers are considered peers where they are all equal (with a few exceptions). Any objects can be added or modified such as adding a user or a user changing their password on any domain controller. These changes are then replicated to other domain controllers. However, with RODCs, changes to the domain controller can come only from other domain controllers. Moreover, the changes are severely restricted to only a few select objects.

The huge benefit of the RODC is that credentials of all users and computers in Active Directory are not replicated to the RODC. This significantly improves the security of domain controllers that are placed at remote locations.