Working with Read Only Domain Controllers(RODC).
hemanth.thummala at gmail.com
Tue Jan 13 17:35:54 MST 2015
We are currently using samba 3.6.12 stack and uses windows active directory
While working with RODCs, we have learned that we need to perform some
manual steps in order to communicate with Read Only DCs consistently.
Basically we found people start working with RODCs in two ways.
1) Join the domain using writable DC and wait for the sync to happen on
2) Perform manual steps which are required by join process.
Approach #1 : Join the domain using Writable DC.
1) Perform domain join now using writable domain controller(net ads join -S
2) Allow this computer account credentials to be cached on RODC. On
writable DC(specified in webUI), run this command:
net localgroup "Allowed RODC Password Replication Group" <Samba server
NetBios name>$ /add
4) On Writable DC, Force the replication of computer account credentials to
command: REPADMIN /RODCPWDREPL <RODC-HOSTNAME> <RWDC-HOSTNAME>
<FQDN of samba server>
At this point, RODC should have the computer account credentials. And
controller should be able to talk to RODC from now onwards.
Approach #2: Join the domain using RODC
1) On one of the Read-Write DCs perform the following operations:
a. Pre-create the computer object and set the custom password for the
cmd: net computer \\<Samba server NetBios name> /add & net user
<Samba server NetBios name>$ <custom password>
b. Allow this computer account credentials to be cached on RODC
eg: net localgroup "Allowed RODC Password Replication Group" <Samba
server NetBios name>$ /add
c. Force the replication of computer account credentials to RODC
eg: REPADMIN /RODCPWDREPL <RODC> <RWDC> <FQDN of Samba server>
2) On CC, need to set the CC account password same as the one provided in
cmd: net -f changesecretpw
This will prompt for the password.Provide the same password given at
We have validated these steps internally and works fine for us. I am not
sure if Samba has some official documentation related to RODC support.
Someone can point me if we have such documentation. If not, we would need
your comments for the same.
Most of these steps are taken from following blog:
More information about the samba-technical