Microsoft Entra Connect can't work against this kind of DC because it needs to write, and Password Protection agents aren't put on one either: its copy of Active Directory can only be read.
Also called read-only domain controller.
In the Ultra Transcenders books
Each book explains RODC in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Entra Connect
Keeps Microsoft Entra ID in step with an on-premises Active Directory by synchronising its identities to the cloud.
- AD
Short for Active Directory, the directory service built into Windows Server (AD DS). Entra Connect synchronises on-premises forests to Microsoft Entra ID.
- CRUD
Shorthand for create, read, update and delete, the four basic things you do with data. Data-plane roles in Azure Cosmos DB, for instance, authorise those operations on items.
Related terms
- Administrator role separation
Lets a user or group administer a read-only domain controller locally without receiving any domain-wide admin rights.
- Password Replication Policy
The set of allowed and denied lists on a read-only domain controller deciding whose passwords it is permitted to cache. Membership of Denied RODC Password Replication Group takes priority over the allowed group.