erver活动目录介绍--成都师范学院课件.pptVIP

Sites Domain controllers WAN links One of the most significant new features for Active Directory Domain Services (AD DS) in Windows Server 2008 is the Read-Only Domain Controller (RODC). An RODC provides the ability to deploy a domain controller that hosts a read-only replica of the domain database. This is well-suited for locations where physical security of the domain controller cant be guaranteed, where network connectivity may have a negative impact on productivity, or where other applications must run on a domain controller and be maintained by a server administrator. All of these scenarios are common in branch office deployments. An RODC holds the same objects and attributes that a writable domain controller holds, and an RODC can be a Global Catalog Server. However, locally originating changes are not made to the RODC replica itself; instead, these changes are made on a writable domain controller and then replicated back to the RODC. This prevents changes made at branch locations from potentially polluting or corrupting the Active Directory forest using replication. Administrators may also specifically configure an RODC to store, or cache, user credentials. The first time a user attempts to authenticate to an RODC, the RODC forwards the request to a writable domain controller. If the authentication is successful, the RODC also requests a copy of the user credentials. The Password Replication Policy determines if the credentials are allowed to be replicated and cached on the RODC. If the credentials are cached, the next time that user attempts to log on, the request can be directly serviced by the RODC until it is subsequently notified, through replication, of a credential change. Credential caching can increase end-user productivity by mitigating the effects of wide area network (WAN) latency or network connectivity issues that are commonly experienced by branch offices. AD DS also maintains a list of all credentials stored on RODCs and, if an RODC is ever co