Back then, I got an unsolicited phone call from a major computer company that was adding a new arm to its consulting division. They found my resume on the Internet, doubled my salary, sent me on consulting gigs across the country, and bought my first house with the discounted stock I bought out of every paycheck.

By the time I left the computer industry (before it became the “technology” industry) there wasn’t a job I couldn’t get an interview for just because I had an MCSE.

(By the way, if you’re wondering, I’m not old. I graduated from college in 1995. I got my certs pretty much right away.)

The Value of MCSE Certifications Today

Of course, things are not the same today as they were then. That is the function of time, to change what was into what is. Nevertheless, the MCSE certification continues to be both a badge of honor among IT professionals, and a powerful card to play when seeking a new job or a promotion.

However, the MCSE gravy train may finally be coming to an end.

When Microsoft first announced its new certification paradigm, there was much hand wringing and more than a few pronouncements that the IT world was doomed. It turns out that those sentiments were premature. The MCSE on Windows Server 2003 stepped in unnoticed as the “next” MCSE certification and IT professionals have been content to pursue, hold, and display the MCSE ever since.

So, what has changed?

Impact of Windows 7

Microsoft released Windows Server 2008 with exactly five years spacing between the last major server OS release (at least based on version number). True to form, corporate IT managers and directors remembered the advice they got somewhere along their career path: “When it comes to Microsoft always wait for SP1.”

That coupled with the diminished economy, budget cuts, and the fact that plenty of companies hated Windows Vista, all add up to Windows Server 2003 remaining the “standard” Microsoft server platform in most enterprises. But, with the release of Windows 7, change is on the horizon.

It has been a decade or more since most corporations last upgraded their operating system. There is no rush to upgrade now, but everyone knows that while Windows XP has become a solid, reliable, work horse, the future is Windows 7.

While there will be no stampede to upgrade to Windows 7 right away (after all, many companies will be waiting for SP1) the fact that an OS upgrade is coming raises some issues.

Perhaps the first question on the minds of IT executives is the order of the upgrades. With most enterprises still running Windows XP and Windows Server 2003, there are two major upgrades in the works. Upgrading to Windows Server 2008 first allows a company to take advantage of the newer, better, faster, easier to use tools to create and distribute an OS upgrade across a large environment.

Windows Server 2008 was released into a world where Microsoft was fully aware that the main upgrade in the enterprise would be from XP to Windows 7, there promises to be less integration issues between Windows 7 and Server 2008; in contrast to Microsoft’s focus the past few years on Server 2003 being used to upgrade XP to Vista.

Even more importantly, Windows Server 2008 not only already has SP1, it also already has R2, which means that more of those real world glitches that are so stubborn to find have been stomped out. Windows 7, in contrast, still hasn’t has a way to go.

MCSE 2008: How I learned to stop worrying and love the MCITP

The new world order that is emerging will soon be looking for system administrators, architects, consultants, engineers, and other IT pros that are certified in Windows Server 2008. They’ll be surprised to find that their former go-to certification, the MCSE is no longer around.

Those keeping an eye on the job boards, especially the more mainstream ones, can expect to see more than a couple postings looking for MCSE 2008 certifications while the world at large slowly comes to terms with Microsoft’s bizarre decision to sacrifice the virtually household name of MCSE for a confusing collection of who-outranks-who certifications.

MCITP is the new MCSE

Microsoft’s PR machine is big, if not effective, and eventually the world will come to at least a basic understanding of the new certification paradigm.

Until then, companies big and small will be looking to map what they already know on top of the new system. When they do, they’ll notice that MCTS can be had with just one exam for one product. That makes it the MCP, or the certification that people use because they can’t get an MCSE, or haven’t gotten there yet.

Then, they will take a look at the MCITP, with it multiple exam requirements across different technologies and products and they will decide that the MCITP is the new MCSE. In other words, shortly after the job postings for MCSE 2008 start appearing, postings for MCITP 2008 will appear without regard to “in what”.

Some hiring managers will overshoot and find themselves woefully lacking in applicants for a position that requires a MCM Server 2008 or a MCA Server Administrator. Then again, perhaps they’ll be flooded with applications that state this, since there is no such thing, perhaps I would be a good match.

How-To Upgrade Your MCSE to MCITP

Microsoft is all too aware that while there are over 155,000 MCSE Server 2003 certifications, there are fewer than 10,000 MCITP Server Administrators. It doesn’t look good when there are not enough people who are “qualified” to handle your products.

Fortunately, for holders of MCSE in Windows Server 2003, there is a very attractive upgrade path to the MCITP certification.

For Server 2003 MCSEs, just one Microsoft certification upgrade exam is required to get three 2008 MCTS certifications — Active Directory, Network Infrastructure, and Applications Infrastructure Configuration.

If you are wondering how to list that kind of certification on your resume and business card — MCTS(3), perhaps? — then you have an idea of why the new certification paradigm is not as user friendly as its predecessor.

Professionals who take advantage of this route can spend the next four or five years as MCSE 2003, MCTS 2008 certified while both the number of companies using Windows Server 2008 and the number of professionals with 2008 certifications slowly starts to build.

For older MCSEs, upgrading to MCITP isn’t as easy. The upgrade exams for Windows Server 2000 MCSEs have already been retired. For MCSE NT4 (like yours truly) the upgrade path involves taking almost all the same exams as someone without a certification. However, many individual exams count toward some of the MCITP requirements, particularly those from the “Choose One” areas.

There will be considerable value in being both a MCSE 2003 and MCITP for the next several years. For that reason, professionals capable of completing the MCSE 2003 certification quickly, would be best off getting their MCSE 2003 and then upgrading it instead of going straight for the MCITP.

Related posts:

• MCSE vs MCITP: Is the MCSE Still Worth It?
• Why Getting Your MCSE Now Is Still A Good Idea
• Dust Off Your MCSE: The New MCTS & MCITP Certifications Are The Future

If you can’t shell out the dollars for System Center Virtual Machine Manager, this might just be an option for your migration to the wonderful world of virtualization.

If you’re not familiar with Windows Deployment Services or Hyper-V in Server 2008, you might want to check out some in-depth training for it.

We’ve also got a few articles covering WDS in case you’re interested and an intro to WDS video.

Enjoy!

Related posts:

• Hyper-V Certification – MCTS: Windows Server Virtualization, Configuration (Exam 70-652)
• Installing Hyper-V Server Role in 7 Easy Steps
• How to Create a New Virtual Machine with Hyper-V

Today I’m going to show you how to prepare for a server upgrade and how to perform it. I’ll also tell you why you need to upgrade your server to 2008; let’s start with that.

Why Upgrade to Server 2008 Anyway?

One of the main reasons why you would want to upgrade all of your Servers on your network from Server 2003 to Server 2008 is the 2008 Functional Level.

Well, that’s great but what does that really mean? Once you upgrade all your Servers and get the 2008 Functional Level you will get few nifty bonuses:

1. The first bonus for upgrading to Server 2008 is Distributed File System Replication. What it means in English is that exchange of information between your Domain Controllers is a lot smoother.
2. Second bonus is Advanced Encryption Standard support for the Kerberos protocol – logins are a lot more secure.
3. The third bonus is Last Interactive Logon Information. This is a Group Policy Object that will display information about previous logons while you are trying to login yourself. So basically, you are going to be able to see who has logged on to the machine before you.
4. And finally, the Fine-Grained Password Policies, where you can specify different password and account lockout policies for different sets of users. I believe this little bonus is quite big for most of the administrators.

The Server 2008 Upgrade Process

The upgrade process is not difficult at all and it doesn’t take a very long time.

There are a couple of steps that you need to do before running the CD to update your server — here they are:

1. Before you start upgrading, make sure that your server’s hardware is up to specifications for Server 2008 (these are the recommendations, for minimum requirements):

• At least 512MB of RAM – preferably a lot more
• At least a 2GHz processor
• At least 40GB of Available Hard Disk space
• DVD-ROM Drive
• At least Super VGA (800×600) monitor
• Keyboard, mouse, NIC Card, etc.

2. If you are upgrading a 2003 Domain Controller, you will need to copy a couple of scripts from Server 2008 disc to your Server’s hard disk and then run adprep/FORESTPREP and adprep/DOMAINPREP.

3. Now we are ready to upgrade so we can put the CD in the CD/DVD-ROM and install as normal.

A note to those who may have Server 2000 and want to upgrade to Server 2008:

You cannot, I repeat, cannot upgrade from Server 2000 directly to Server 2008.

You need to upgrade it first to Server 2003 and then go through these steps and upgrade to Server 2008.

Also, make sure your Domain Functional Level is Windows Server 2003. This is really important as you won’t be able to run the upgrade if Domain Functional Level isn’t at Least Server 2003.

Warning: What You Need to Know Before Upgrading

There are a few things you should be aware of before starting the upgrade process:

1. 2003 Servers should be patched to at least SP1
2. Small Business Server 2003 and 2003 R2 upgrades are not supported
3. You can’t upgrade to Server Core
4. Exchange Server 2007 will not take an in-place upgrade. This is very important, because if you try it will break things. What you need to do is a Mailbox Migration to do this kind of upgrade with Exchange 2007

Preparing Server for Upgrade

1. Login to your Domain Controller on the server you are upgrading. First we are going to prepare the Domain Controller Database for upgrade.

2. Go ahead and insert the Server 2008 CD in your CD/DVD-ROM drive.

3. Open My Computer and right-click on CD/DVD-ROM. Then select Explore.

4. Double-click on Sources.

5. Right-click on the adprep folder and select Copy.

6. Now go over to your server’s hard drive and paste the folder on your C:\ drive. In this example, we are going to paste it in the root of C.

7. Next, select Command Prompt on your start menu.

If you do not see Command Prompt, select Run, type in cmd and hit the Enter key.

8. When in Command Prompt, type in cd\ and hit Enter.

9. To verify that the adprep folder is on your hard drive, type in dir and hit Enter.

10. Next, type in cd adprep and hit Enter. This will put you in the adprep folder.

11. Once you are in that folder we are ready to run the two commands. The first command you should type is adprep /forestprep, then hit Enter.

12. Make sure you do not have any Windows Server 2000 machines on your network.

If you do not, type in C and hit Enter.

13. Once the process is done you are going to receive a quick confirmation as shown below.

14. Next we are going to type in the second command which is adprep /domainprep and hit Enter.

15. Domainprep will now run and once it is done you will receive a confirmation.

16. You can now close the Command Prompt.

Now we are finally ready for the upgrade.

Quick note for administrators with multiple Domain Controllers that need to upgrade to Server 2008:

The steps above need to be performed only once on your network. Once you run forestprep and domainprep on your network, all your Domain Controllers are now ready for the upgrade. All you need to do is wait for the Active Directory database to replicate to all your DCs and you are ready to go.

Upgrading from Server 2003 to Server 2008

1. Make sure your Server 2008 CD is in the CD/DVD-ROM drive. On your machine, go to Windows Explorer and select CD/DVD-ROM. In this example it is the D:\ drive.

2. Double-click on the setup.exe file from inside your Server 2003 machine.

3. When the Install Window opens click the Install Now button.

4. In this window you will have an option to check for the latest updates from Microsoft. If you choose so, please select the first option.

In this example we are going to skip them for now, so we will select the second option.

5. It’s now time to select the Server 2008 version that you want to install.

In this example we are installing the Enterprise (Full Installation) version. Once you make your selection, click Next.

6. Go ahead and check the box to accept the license terms agreement and when ready click next.

7. The upgrade option should now be available for you. When ready select Upgrade Option to continue.

8. You will receive one last warning letting you know to make sure all your applications and 3rd party software can run on windows 2008 as well as of potential issues that you might have.

Make sure to read it and pay close attention to any issues that are listed on the bottom. Once you are ready, click Next.

9. Your Server is now being upgraded.

One last thing to keep in mind is that the upgrade process may take a lot longer than the installation as it has to upgrade the Active Directory and other services that are already on your Server.

Now, wasn’t this easy?

Related posts:

• Upgrading to Server 2008 R2 in 8 Easy Steps
• How to Install Windows Server 2008
• Server 2008 Active Directory: Adding a Child Domain

However, no one expects this to be a quick transition. IPv4 support will likely be necessary for years or decades to come.

Luckily, Windows Server 2008 comes equipped with standard features to help with the move to a new network protocol.

Allowing for interoperability between IPv4 and IPv6 networks is not a trivial process. Fortunately, the designers of IPv6 have already come up with most of the framework to handle the interplay.

At the top of the list is Intra-Site Automatic Tunnel Addressing Protocol or ISATAP (ah, more acronyms).

With ISATAP, when a network in your site that is running IPv6 needs to talk to a network running IPv4, a properly enabled router will encapsulate the IPv6 packets inside of IPv4 packets and in the reverse, add IPv6 headers to incoming IPv4 packets.

The best part is that there is nothing for the workstations or servers to do. For all they know, they are talking to the same kind of network.

What if your organization is all about IPv6, but they have to communicate over a non-IPv6 network like the Internet?

Another technology known as 6to4 automatically creates tunneling between the networks by temporarily packaging the IPv6 packets inside IPv4 packets and then returning them to their original state when they arrive at their destination.

What about an application that uses IPv6?

For that, Microsoft utilizes Teredo. In Windows Server 2003, Teredo wouldn’t work with domain member computers. Not any more. Now, Teredo is supported on domain member computers and domain controllers so there will be no seams in the IPv4 and IPv6 networks from an application standpoint.

What Do I Have to Do?

So far, there isn’t any work for the average systems administrator here. "Hey, what are we waiting for?"

Well, besides the network guys freaking out (this will be tougher on their end), there are a some Windows Server functions you’ll have to get right first.

One of them is DHCP. Right now, all of your DHCP servers are configured with IPv4 scopes and happily doling out those addresses to all comers. Windows Server 2008 supports DHCPv6 which is, of course, DHCP using IPv6 addresses.

Although a Server 2008 DHCP server can send out both kinds of addresses, there is still no way to “translate” how an IP address is assigned, so you’ll have to re-create your scopes to get the right IPv6 addresses out there to the right systems.

The tough part will be making sure that systems you want getting IPv6 addresses get IPv6 addresses and the others get the IPv4 addresses.

DNS is another tricky spot. IPv6 addresses will be AAAA (quad-A) records in your tables. Obviously, your IPv4 DNS servers won’t have any idea what those are.

Also, since there is no way the average non-photographic memory systems administrator will be able to memorize IPv6 addresses of more than a couple of severs (if any), name resolution is going to have to be more robust than ever.

To this end, all domain controllers will host DNS which will complicate your efforts to define who contacts which DNS process.

The good news is that configuring these services will be pretty much the same as it is now, only the input field will take IPv6 addresses instead of the four blanks separated by periods (and since IPv6 address can be abbreviated, there will be no more automatic cursor movement to the next field, so the backspace key will actually work if you fat finger part of the address instead of stubbornly refusing to move back to the previous dotted section).

For example, manually configuring an IP address takes place in the same way, on the same screen. You’ll put in the default address and default gateway in the same fields. The only difference is that you will be typing a lot more.

Benefits of IPv6

There is more in the move to IPv6 for you than just saving the Internet (a noble goal in and of itself).

The IPv6 standard allows for TCP to be offloaded down one level. So, your new network cards will handle TCP at the hardware level, and your old ones will still benefit from processing occurring in the miniport.

This means less work for your servers and more power for your users.

Another huge benefit is that you will finally be able to get rid of WINS!

A newer more robust service that works tightly with DNS called GlobalNames Zone will handle all the simple name (non-fully qualified) resolution for your network. In fact, this may be where you want to get started with your migration.

The biggest time saver will be the ability to make network configuration changes on the fly without a reboot.

IPv6’s stack allows for the ability to retain configuration settings so those late workdays where you have to stay just to make sure a reboot goes through are over (at least for IP configuration changes).

Thanks to the translation protocols provided at the router level and the fact that all Windows Server 2008 systems will have fully integrated IPv4 and IPv6 stacks means that the migration to IPv6 will be as painless as possible.

Of course, there is no way it will be pain free. Then again, if it was easy, everyone would do it, and you would get paid a lot less.

Related posts:

• Windows Server 2008 IPv6 — The Future of Internet Protocol
• Install DHCP Role on Windows Server 2008
• Configure DHCP on Windows Server 2008

A long time ago, in a galaxy not so far away, there was the Internet.

The Internet was a network that allowed information to be shared between computers regardless of their location. It was pretty cool.

Of course, you had to know Unix in order to do anything useful, and getting a file meant using the command-line FTP command (and hopefully remembering to set your type to binary when necessary).

Frankly, there were only a few people capable of doing such things, but nevertheless, the designers of this revolutionary Internet-thingy built an addressing scheme with TONS of room for computers to be added.

They called it IPv4.

Bill Gates once famously said that 64K was more memory than anyone would ever need. It’s hilarious today considering you can’t even run Notepad in 64K and Windows Server 2008 requires a minimum of 1GB of RAM.

Still, it can be hard to see the demands of the future. A similar fate befell those intrepid pioneers of the Internet, who in a slightly wiser move, created a way to address computers using the now very familiar dotted notation.

Theoretically, the IPv4 specification could support up to 4.2 billion different machines. Considering that less than 10,000 computers were connected to the Internet in 1995, this probably seemed like plenty of space. Times change.

Having just one computer used to be a big deal for the average family. Now, most people in America have at least one, and plenty of people have two, three, or more. Not to mention, all the other countries and their multitudes of users. And, that doesn’t even include the vast number of servers out there, plus all those newer must-have gadgets that need a way to connect to the Internet.

In the end, like Bill Gate’s 64K of memory, the IPv4 address space has proved to be too small.

Welcome to IPv6

None of this is a surprise to the engineers that help set the standards for the Internet. However, considering that IPv4 has been widely adopted across virtually every company, product line, hardware vendor, and country in the world, changing the standard is not small matter, and certainly not something anyone wants to have to do again in this lifetime.

Which brings us to the IPv6 standard and Windows Server 2008.

None of this is a surprise to you either. As a competent systems administrator, you know all about IP addressing and the difficulties involved in getting fixed IP addresses for your external facing servers.

You’ve seen the forms and the ridiculous third-degree you get from your ISP when you want another address. You know that IPv6 actually came on Windows Server 2003, but chances are you haven’t implemented it yet. After all, it didn’t really seem all that necessary and why make extra work for your team?

With Windows Server 2008, things are different. For starters, unlike in Server 2003, in Server 2008, IPv6 comes installed and enabled by default.

In Server 2003, IPv6 was a separate protocol. In Server 2008, IPv6 is part of the standard TCP/IP stack in compliance with current standards. (In order to help with the transition to IPv6, IP stacks handle both IPv4 and IPv6 packets.) So, you couldn’t even uninstall IPv6 if you wanted to. Not that you would want to because the stack will work perfectly fine with either IPv4 or IPv6.

Actually, as Microsoft prepares for the future, many of its core server features are already starting to support IPv6 and using them on your current IPv4 network actually involves backwards compatibility mechanisms instead of the other way with Server 2003 using compatibility mechanisms to handle IPv6.

You’ve probably read elsewhere about IPv6, but here is a quick refresher.

• IPv6 addresses are 128 bits written as eight sets of four 16-bit hex digits
• Looks like this: 2001:db8:bc92:0000:0000:1293:91c2:0012
• The IPv6 header is always exactly 40 bits.
• This is huge for that overburdened network hardware that spends a lot of computing power detecting where the IPv4 header ends.
• IPv6 supports up to 3.4 x 1038 addresses and the addresses will be hierarchical, meaning that the start of an address will give some indication of its location.

See Your Introduction to IPv6 for a more detailed overview.

IPv6 in Windows Server 2008

So, how exactly does IPv6 figure into a Windows Server 2008 environment?

For starters, the days of memorizing IP addresses is pretty much over. Right now, one of your goto moves in troubleshooting is to try and connect via IP address. You’ll need a list if you want to do that in IPv6, so you need to make sure your name resolution is rock solid. Which brings us to WINS.

Since the days when Microsoft was only fit for tiny networks, WINS has been around as a way to resolve simple names on small networks. Though WINS was better than the old computer browser, it was still a bit of a kludge on an otherwise solid platform. That dinosaur is finally going away, replaced by the GlobalName Zone or GNZ.

The good news is that most of your same tricks for IPv4 will work seamlessly with IPv6.

Need to PING a computer? No problem. Same command, same results, actually, better results. To PING by address, no change is needed. To PING by name, you’ll need to throw in the ipv6 switch. But, you also get additional switches enabled by the new header including the ability to do a round-trip traceroute to see not only how the traffic gets there, but also how it gets back.

Of course, any transition this big won’t be a no-brainer. In order to use IPv6, your routers will have to support it. If they aren’t ancient, this won’t be too much of a problem since the router companies have been building in IPv6 longer than anyone else.

Also, your firewalls and intrusion detection systems will need to support the new protocol. This is where things get interesting.

Because of the new header, the entire protocol stack can be filtered against, so you can get even more granular with your rules and block out some of the current tricks. You’ll also have to get a pool of IPv6 addresses and configure your DNS and DHCP servers to handle those.

Fortunately, the designers of IPv6 included several migration standards as well, all fully supported in Server 2008.

For example, a tunneling protocol allows for IPv6 packets to be encapsulated inside IPv4 packets so that when they hit an IPv4 network, they sail along as planned.

In short, there is a lot of work ahead, but it seems that Windows Server 2008 will be fully up to the task. That is, whenever you are.

Related posts:

• Migrating to IPv6 with Windows Server 2008
• Windows DNS Server 2008: Setup External Internet DNS Server
• Install DHCP Role on Windows Server 2008

The computer systems for the XYZ Company were managed by professionals whose full-time job was to install, configure, and maintain the systems.

So if Joe in accounting had a problem with his computer he would call you or Ted, or one of the other admins, and you would stop by Joe’s desk on the way back from grabbing a bagel in the company cafeteria.

If the XYZ Company got big enough it would open up another office. Management would decide which employees should be in which location.

Accounting might stay in the original headquarters while you and the marketing group moved to the new location ("So long, Joe.")

Along the way, things changed …

Companies needed not just two or three big offices, but maybe two or three big offices and DOZENS of smaller offices. Some of those offices might have just a handful of employees.

Your average Sys Admin would get pretty bored maintaining just eight computers. The XYZ Company is not interested in paying for a fully qualified systems administrator for a dozen offices if they aren’t going to be fully utilized.

So, IT responsibilities get handled by a technician or in some cases by Rob, the contracts guy.

Now, Rob is a good guy. He makes sure the Nowhereville office’s contract get approved quickly, and he also manages the local softball team.

His wife is the manager at the local grocery store/video store/bowling alley/Post Office.

The thing about Rob is, that although he is a good guy and can change a printer toner in less than eight minutes, he doesn’t really know a lot about servers.

So, when the professional looking gentleman in the uniform that looks kind of like the ones the phone company guys wear shows up to make the network faster by tuning the Domain Controller, well … Rob points him in the direction of the "big computer" and offers him a cup of coffee.

You Ain’t Got a Thing If You Ain’t Got Physical Security

Microsoft has spent millions of dollars and many years working on the security for its Windows Server products. These days, a Microsoft Server is about as secure as any server can be; that is if you are coming at it from over the network.

With the proliferation of remote offices for companies both big and small, there are more and more computers out there. The workstations are secured in their own way, and if one is compromised by theft or a local administrator run amok the damage is limited to whatever was on that system.

There really is no way to leverage a single computer into enterprise access once the system has been removed from access.

But, the Computer Grinch is not so easily defeated, and one day he got an idea, a really fantastically rotten idea. If he got a Domain Controller he could take as much time as he wanted to get inside at the goodies, and when he did, he would have a way into your whole enterprise right in his hairy green hands.

For a smaller organization it might be possible to rebuild the Directory for security purposes, but for a large organization with hundreds or thousands of man-hours in the design, development, and implementation of a complex Active Directory, that isn’t a viable option.

Just hoping that the Computer Grinch doesn’t work something out isn’t very viable either.

Reading, No Writing, Rithmitic

Although this scenario sounds a bit far fetched, computer hackers aren’t just going to go away. And with good full scale attacks becoming harder to implement thanks to the growing use of firewalls, secure server systems, and even savvier users, the idea of walking off with a domain controller starts to look a little bit better.

So Microsoft has developed the Read-Only Domain Controller. The Read-Only Domain Controller (RODC) is pretty much the same thing as a Writable Domain Controller as far as your users and their resources are concerned. Where it is different is in how its AD database is handled.

Here is a quick point of terminology. Microsoft considers a regular "writable" domain controller to be a Domain Controller. A non-writable domain controller is a Read-Only Domain Controller.

So, if you see the phrase "Domain Controller" it means a full writable Domain Controller. Only if you see the words "Read-Only" or the letters RODC should you think "read only."

The RODC allows your enterprise to put a controller in any office regardless of the level of security that office has. If you want to put a RODC underneath the receptionist’s desk or next to the vending machine, that’s fine. (It’s not great, so if you have a better spot then use it.)

A RODC contains, as one might expect, a Read-Only Active Directory Database, but it isn’t as simple as it sounds.

For starters, the database isn’t really read-only in the traditional sense. The data can be, and is, updated. It is just that the updates only come in one direction: FROM the other domain controllers.

So, any changes that might be made by someone using a compromised local administrator password or a disgruntled field technician won’t be replicated back into the Enterprise. The damage is limited to the RODC.

This means that even if a domain controller was stolen there is no need to change your entire Directory because every second the stolen domain controller is off the network, its database gets staler and staler until it is completely worthless even to the most talented of hackers.

This level of security also provides a way around that nasty problem of needing someone to handle something locally on a domain controller that requires an administrator password like installing a driver or replacement hardware.

In Server 2003 giving someone an administrator password on the domain controller means giving the full access to the enterprise’s Active Directory. While Mr. Local is politely saying, "Ok. Yeah. Ok," to your directions over the phone, he could be giving his user account admin rights. Or, if he’s a little smarter making a new hard-to-spot account with admin rights. Neither one is a good thing.

On the other hand, while giving someone a local admin password to a RODC does give them full access to that machine, it stops there. No changes that are made while in the RODC get propagated back to the enterprise, so your guy gets nothing out if it.

Not a Problem

The most common thing I hear when people learn about the Read-Only Domain Controller is that physical security of the Domain Controllers isn’t a very big problem. I always respond with one word, "Yet."

In the end, the RODC solves a fairly uncommon security issue, that of domain controller theft, and a slightly more common security issue of employee tampering.

It’s likely that neither causes your organization much trouble today, and that is a good thing. By implementing the Read-Only Domain Controller now, you can make sure it stays that way.

And, isn’t it nice to be out in front of the danger instead of catching up?

Related posts:

• To RODC or Not To RODC, That Is the Question
• How to Setup & Utilize RODC on Server 2008 Server Core
• Server 2008 Active Directory: Adding a Child Domain