[Samba] machine account on RODC

[Rowland Penny]

On Thu, 22 Nov 2018 17:29:16 +0100
Stefan Kania via samba <samba at lists.samba.org> wrote:

> Hello everybody,
> 
> if I set up a RODC in a different site with an own subnet do I have to
> replicate the machine-passwords with "samba-tool rodc reload host\$
> --server=addc"? Or can a machine always authenticate against a RODC?
> 

It is my understanding that an RODC never really does authentication
like a normal RWDC. When authentication is asked for, the RODC first
checks its cache and if the required data is cached, authentication is
granted. If it isn't cached, an RWDC is queried which authenticates
the request, if appropriate, and the RODC then, if configured to do
so, asks for the password to be replicated to the RODC.

Pre-loading passwords just speeds things up initially, but you will
have to consider whether you really need the passwords on an RODC,
this sort of defeats the point of an RODC.

Rowland