How Do I Prevent Domain Controller Changing?

Murat Er 1 Reputation point

We have 3 domain controllers one of Master DC another one ADC and last one is Read Only DC.
Read Only DC is being used for remote office domain services.
If I login at RODC , I can click "change to domain controller" then changing domain.

Is there anyway to disable this attribute at schema or regedit? I don't want to change domain controller for any admin who can login RODC?

thanks. 134554-change-domain-controller-setting.png

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
4,359 questions
0 comments No comments
{count} votes

4 answers

Sort by: Most helpful
  1. Dave Patrick 354.3K Reputation points MVP

    What problem does this cause? This only changes the active domain controller in that MMC instance.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

  2. Thameur-BOURBITA 16,591 Reputation points


    As mentioned by Patrick , you can change domain controller on MMC instance, it can be done from any machine where active directory tools installed (RODC,member server, workstation, domain controller).
    If you want prevent any change launched from RODC servers, you should check the permission of each admin account allowed to login on RODC ,avoid put all admin account on domain admin group, and prevent all domain admin account to longon on RODC servers.

    Please don't forget to mark helpful reply as answer

    0 comments No comments

  3. Murat Er 1 Reputation point

    Hi Patrick and Bourbita,

    You are right but our organization has different admins who have some permisson at Active Directory Console. On the other hand by default Domain users have permission to read some AD objects.

    I think that, I can remove or change passive to change domain controller menu via schema setting or attribute setting.

    If I can prevent this action by delegation, do you have any delegation sceranios?


    0 comments No comments

  4. Dave Patrick 354.3K Reputation points MVP

    Some ideas here.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments No comments