Domain Join against RODC

Question

Hi All,
We are facing a issue with domain joining against RODC
We have a RODC which is separated from RWDC using firewall. The replication is configured using IPSEC and all is working fine.
The servers in RODC site do not have any connectivity to RWDC. We add the Servers in RODC site by following the script mentioned in the below link
https://technet.microsoft.com/en-us/library/dd728035(v=ws.10).aspx
The Servers which are in same subnet as RODC are able to join and login properly into the Domain. But the servers which are in different subnet are not able to join Domain and giving error “ Specified Domain either does not exist or cannot be contacted”
I am able to ping the RODC using IP and FQDN but not using netbios name
Nslookup works for FQDN of RODC and Domain name but fails for netbios names
I have checked the link http://blogs.technet.com/b/networking/archive/2008/07/25/netbios-browsing-across-subnets-may-fail-after-upgrading-to-windows-server-2008.aspx and as per that the browser service is started in PDC as well as in RODC
The subnet of Server is associated to RODC site
I have created a registry entry SiteName in the server and specified the RODC site
Checked at network level and nothing is blocked there
Tried creating the record for in host file but no use

Answer 1

Hi All,
We are facing a issue with domain joining against RODC
We have a RODC which is separated from RWDC using firewall. The replication is configured using IPSEC and all is working fine.
The servers in RODC site do not have any connectivity to RWDC. We add the Servers in RODC site by following the script mentioned in the below link
Firstly if you have RODC in a site, place a RWDC in that site as well OR enable
Bridge all site links. Also you need to provision the computer accounts in your RWDC, in that case the computer accounts will be replicated to the RODC and you can join. Look at RODC section here:
Offline Domain Join
Reading this link by Jorge is highly recommended:
Domain Join through an RODC instead of an RWDC
Do not forget that if your windows server are 2003 they need to have direct connectivity to the RWDC for tasks like password changing. Also for time synchronization, an RODC is authorized to sync the computers time if and only if the computer password is
cached, otherwise the computer must contact the RWDC directly.
Mahdi Tehrani   |  
  |  
www.mahditehrani.ir
Please click on Propose As Answer or
to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?