Configuring password caching on RODCs

When you first deploy an RODC into your Active Directory environment, you need to configure the Password Replication Policy on the writable domain controller that will be the replication partner for the RODC. This policy functions as an access control list that determines whether or not the RODC should cache passwords for user and computer accounts in Active Directory. The steps for configuring the Password Replication Policy for an RODC are explained in this article in the TechNet Library.

A good deal of the problems businesses often experiences with RODCs result from incorrectly configured Password Replication Policies for their RODCs. For example, one company I know deployed RODCs at several remote branch offices for better security. Then because of hardware failure the WAN link went down for more than a week between the company’s head office and one of their remote sites, and after a couple of days several users at that remote site could no longer access any local resources at their own site because the RODC would no longer authenticate them. The users at the remote site became frustrated, the manager complained, and the IT person got mad at Microsoft for designing RODCs so badly!

Of course, the real problem was that the IT person had not properly configured the Password Replication Policy for the RODCs at the remote sites. The Password Replication Policy for a RODC includes a built-in security group named Allowed RODC Password Replication Group which by default grants to the members of this group the ability to cache passwords on any RODC in the domain where the RODC resides. However, it’s not enough to just add the user accounts of users at the remote site to this group. You should also add the computer accounts of the computers at the remote site to this group. As it says in Appendix A of the RODC Planning and Deployment Guide on TechNet:

“Caution: For an RODC to authenticate a logon request locally, both the user and computer credentials must be cached locally. If the user’s credentials are cached, but the computer credentials are not cached, the RODC cannot provide a service ticket for the user to log on to the computer. If a network outage prevents the RODC from contacting a writeable domain controller running Windows Server 2008 or later, the RODC will not be able to provide a service ticket for the computer account and the user logon will fail.”

It’s also important to realize that just because you’ve specified the list of user and computer accounts that are allowed to be cached by the RODC doesn’t mean that the passwords for those accounts have actually been cached. The way around this issue is to manually pre-populate the logon credentials for user and computer accounts that you need the RODC to be able to authentication. The procedure for doing this is described in the section titled “Prepopulating the password cache for an RODC” on this page in the TechNet Library. Be sure also to read the Note at the end of this section concerning latency between the RODC and the writeable domain controller after PRP permission changes are implemented.