Replacing a writeable domain controller with an RODC

The process for replacing a writeable domain controller with an RODC is the same regardless of whether or not it is deployed in a perimeter network. It is not possible to migrate a writeable domain controller to a RODC. The best practices for replacing a writeable domain controller with an RODC are described in the Read-Only Domain Controller Planning and Deployment Guide (https://go.microsoft.com/fwlink/? LinkID=135993).

Because deployments of AD DS in perimeter networks have existed long before RODCs, it is assumed that some organizations that are interested in deploying RODCs already have an existing AD DS deployment. For example, the organization in Figure 6 has an existing perimeter network.

Figure 6 An organization with an existing perimeter network

The perimeter network has an application server that hosts a custom ADSI application, client computers, and a domain controller that runs Windows Server 2003. The organization is planning to replace the existing domain controller with an RODC to gain the advantages of RODCs. The new solution, after RODCs are deployed, is shown in Figure 7.

Figure 7 A writable domain controller replaced by an RODC in the perimeter network