Read Only Domain Controller

Roger Roger 4,951 Reputation points
2022-06-01T20:13:39.6+00:00

Hi Everyone

I have a requirement to setup Read Only Domain Controller. I have never setup any domain controller earlier.
i have two writable domain controllers DC1,DC2 which are 2019 OS. I need to setup a RODC in DMZ which is RODC1. Please guide me.

I came up with new windows 2019 server lets say RODC1.my all servers are hosted in azure.

As per the below article i will restrict RPC traffic to a specific port.
https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/restrict-ad-rpc-traffic-to-specific-port

On the new RODC1 i will modify the below registry values.
Step1--> i will perform this.
Registry key 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Registry value: TCP/IP Port
Value type: REG_DWORD Value data: 9985

Registry key 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Registry value: DCTcpipPort
Value type: REG_DWORD Value data: 9986

Step2-->
https://blogs.technet.microsoft.com/askds/2009/07/16/configuring-dfsr-to-a-static-port-the-rest-of-the-story/

dfsrdiag staticrpc /port:9987
Do i need to execute the above command on DC1,DC2,RODC1 or only on RODC1?

Step3-->Since my RODC is in DMZ what ports do i need to allow so that this RODC can communicate with writeable Domain Controllers DC1 and DC2.

Step4-->Install RODC i will follow the below article
https://dailysysadmin.com/KB/Article/3947/how-to-create-a-windows-server-2019-rodc-or-read-only-domain-controller/

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,398 questions
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,348 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,519 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,724 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,020 questions
0 comments No comments
{count} votes

Accepted answer
  1. Dave Patrick 425.7K Reputation points MVP
    2022-06-01T20:15:44.363+00:00

    You'll find the ports listed here.
    https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts#windows-server-2008-and-later-versions

    --please don't forget to upvote and Accept as answer if the reply is helpful--


1 additional answer

Sort by: Most helpful
  1. Roger Roger 4,951 Reputation points
    2022-06-03T03:00:39.61+00:00

    i am not clear on this

    Step2-->
    https://blogs.technet.microsoft.com/askds/2009/07/16/configuring-dfsr-to-a-static-port-the-rest-of-the-story/

    dfsrdiag staticrpc /port:9987
    Do i need to execute the above command on DC1,DC2,RODC1 or only on RODC1?

    0 comments No comments