RODC as a "backup" DC

hi all,

i've received 2 relatively beefy servers replace 4 of our current servers. i'm using windows server 2008 r2 , i've added hyper-v role both servers. 1 of host machines our domain controller , planning on having virtual machine on second new server backup domain controller. 

i know times have changed , roles of "primary" , "backup" dc's (apparently) not relevant. though our international sites connected via private mpls, each site on different subnet on same domain. since we're newest site, i've ever had 1 dc on site. had idea of setting second (low resource vm) dc rodc. idea is, if first dc down reason, users still able log on querying rodc vm. 

is there merit in doing this? understand concept of rodc's tackling "branch office" setup, rodc work backup domain controller on same site well?

no.  rodc default not authenticate anyone, forwards request writable dc.  have manually define user , computer accounts on rodc *can* authenticate without contacting writable dc.  in branch office scenario, if stole dc know accounts need reset because small number "cached" or defined authenticate users.   deploy rodc in scenario have physical security risk.  sounds need deploy standard dc in site.  in way, if dc#1 goes down, clients contact dc#2 based since defined way in sites , services.

---

dave guenthner [msft] posting provided "as is" no warranties, , confers no rights. http://blogs.technet.com/b/davguents_blog

Windows Server  >  Windows Server General Forum