Syncing devices to ad aconnect with rodc

Mohamed jihad bayali 1,141 Reputation points
2026-06-06T13:44:23.5966667+00:00

hello,

i Hope you can help me about m’y query

i have vlan 1 : contains rwdc

vlan2 : contains rodc

vlan3 : contains w11 machines

machines on vlan3 are on a remote site, and they use the rodc to auth.(they don’t see rwdc, network is blocked)

rodc and rwdc network flows are opened in both ways, meaning rodc can perfect’y sync with rwdc.

ad connect is syncing from rwdc:

my need is to hybrid join machines on vlan3 to entraid, network flows between devices and entraid urls for registration are well opened… etc

When trying to perform the sync, I see that thé machines dont sync on ad connect, after some débug, i can see that ad Connect is ignoring them from sync process, bécause they don’t havé « usercertificate » attribute populated… which it mâke sense from my point of you, because during the entra id hybrid join process, the device generate a self signed certificate and Will try to update itvalue to the user certificate attribut…but since the device see only an Rodc..the process fail…and the attribute keep being empty

I want to know if there is a workaround except from opening flows to rwdc

thanks

Microsoft 365 and Office | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-06T13:44:38.3966667+00:00

    There is no supported workaround in the provided information that allows hybrid Microsoft Entra join of Windows devices that can reach only an RODC and not a writable DC, without opening network flows from those devices to an RWDC.

    Relevant points from the context:

    • RODCs forward write operations (such as password changes or other attribute updates) to an RWDC and then receive the replicated changes back. They are not themselves writable for directory attributes.
    • The userCertificate attribute must be written to a writable domain controller. In the described topology, the Windows 11 devices on VLAN3 can reach only the RODC, so their attempt to write userCertificate during hybrid join cannot complete against an RWDC.
    • The RODC–RWDC replication and security channel behavior described does not provide an alternative path for the device to complete the required write operation if it cannot directly reach a writable DC.
    • The only workarounds mentioned for RODC-related issues in the context involve either changing site/topology so that an RWDC is reachable from the RODC’s site, or disabling certain operations (for example, disabling account password changes for computers that use an RODC for their security channel). None of these provide a method to complete hybrid join without RWDC reachability.

    Based on the available information, achieving hybrid join for those devices requires changing the network design so that the devices can ultimately write to a writable domain controller (for example, by allowing them to reach an RWDC directly or by placing an RWDC in the same or a reachable site). No alternative, supported workaround is documented in the provided context.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.