Add RODC Creation Support

[PlagueHO]

Is there any plan to add support to install a server as an RODC?

[oradcliffe]

Commenting here as I am also curious if this will be supported. Otherwise, I guess using a custom script block in the DSC template will do?

[capocruz]

I'd like to see RODC in DSC as well. It's now 2017 and it's a simple parameter creation. Maybe write our own??

[SSvilen]

Hi @johlju - is this still relevant?

[johlju]

@SSvilen If someone want to add this then I'm all for it, happy to review a PR that adds this. 🙂

[SSvilen]

I need to pre-provision the RODC account and then i need to promote it. Do I pick up a single domain controller to work with for both operations or is there another standard for such operations?

[johlju]

The cmdlet Add-ADDSReadOnlyDomainControllerAccount can only specify the domain name and site name, so you could create the account on any DC and it should replicate, and it must of course have replicated before promoting the RODC. You can also specify the replication source DC if the RODC should replicate from a specific domain controller, so the account must have replicated to that DC before promoting the RODC.

[johlju]

Not sure we should have a resource that creates that pre-staged account, should we? It is one-time thing, and nothing that can be enforced, and needs to be done by a domain admin. I think to solve this issue I think we at least need to support the parameter ReadOnlyReplica in the resource xADDomainController (for the cmdlet Install-ADDSDomainController).

[SSvilen]

You are right - you can provision RODC with Install-ADDSDomainController directly. But we could also build the functionality to pre-provision the account, couldn't we? I would still a part of xADDomainController - just a separate set of options.

[johlju]

Creating a pre-staged (computer) account sounds more something xADComputer would do, not xADDomainController. Or another (new) resources.

But what node should create the pre-staged account? It wouldn’t be the node that will end up as RODC, because then it wouldn’t make since to use a pre-stage account in the first place. The node that should be RODC should be using xADDomainControlle with ReadOnlyReplica and an optional Credential that allows the DC to use the already created pre-staged account.

It’s not really making since to me to create the pre-staged account using a DSC resource. 🤔 It’s because it is a one time operation, the account cannot be enforced, nor can it enforce any properties.

Can someone provide a scenario where it would be good idea to have that functionality in a DSC resource?

[jojiklmts]

2019. Where is my RODC provisioned with PowerShell DSC?

[johlju]

@jojiklmts sorry, not following you. But if you mean the support for RODC it has been merged and will be included in the release of ActiveDirectoryDsc (which hopefully be soon).