Deploying Windows Server 2008 Read-Only Domain Controllers in Your Existing Environment

The Microsoft Consulting Services Infrastructure Team in Ireland has a post on a very useful feature of Windows Server 2008 Active Directory Services: the read-only domain controller (RODC). It's especially useful if your network has branch offices or other edge sites.

The Read-Only Domain Controller (RODC) is primarily targeted toward branch offices or edge sites. RODC doesn’t store any passwords, by default. That way, if the RODC is compromised, then an administrator doesn’t have to worry about someone gaining access to the entire network using the information stored on that server. This addresses the lack of security that can occur at branch offices. So the threat to the Active Directory is drastically reduced.

The post lists five easy steps that, once completed, allow you to deploy RODCs in a Windows Server 2003 Active Directory environment.

For a step-by-step guide to RODCs, check out TechNet's article on the topic.