Manage RODC Account Security: Cached Credentials and Password Reset

Review the allowed and denied lists

Get-ADDomainControllerPasswordReplicationPolicy -Identity $Rodc -Allowed
Get-ADDomainControllerPasswordReplicationPolicy -Identity $Rodc -Denied

# repadmin equivalents
repadmin /prp view $Rodc Allowed
repadmin /prp view $Rodc Denied

GUI path:

See what is cached and who has authenticated

# Secrets currently stored on the RODC
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -RevealedAccounts

# Accounts that have authenticated to the RODC (not necessarily cached)
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -AuthenticatedAccounts

# repadmin equivalents
repadmin /prp view $Rodc Reveal
repadmin /prp view $Rodc Auth2

In dsa.msc, open Advanced on the Password Replication Policy tab. It lists revealed and authenticated accounts and has a button to reset their passwords.

What to look for: any privileged account, service account or Domain Admin in the revealed list means the policy has failed. Authenticated-but-not-revealed accounts are the ones a loose allow list would cache next.

Change the allowed and denied lists

# Per-RODC allowed group (preferred over the domain-wide Allowed group)
Add-ADDomainControllerPasswordReplicationPolicy -Identity $Rodc -AllowedList "<BRANCH-ALLOWED-GROUP>"
Remove-ADDomainControllerPasswordReplicationPolicy -Identity $Rodc -AllowedList "<OLD-GROUP>"

# Extra denied accounts for this RODC only
Add-ADDomainControllerPasswordReplicationPolicy -Identity $Rodc -DeniedList "svc-backup"

# repadmin equivalent (the group is passed by distinguished name)
$grp = (Get-ADGroup "<BRANCH-ALLOWED-GROUP>").DistinguishedName
repadmin /prp add $Rodc Allow $grp

Use -DeniedList for exceptions on one RODC. To block an account on every RODC, add it to the Denied RODC Password Replication Group.

Pre-cache an account that must log on offline

repadmin /rodcpwdrepl $Rodc $Dc "CN=user1,CN=Users,$DomainDN"

Only do this for accounts that are in the allowed list and not in any denied list.

Prevent and purge: treat a cached secret as exposed

• Prevent: add the account to the RODC’s denied list, or to the Denied RODC Password Replication Group.
• Purge: removing an account from the allowed list, or denying it, does not reliably evict a secret that is already cached. Reset the password on a writable DC, then confirm with -RevealedAccounts.

# Review the list first. This resets every revealed user, which is disruptive.
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -RevealedAccounts |
  Where-Object objectClass -eq 'user' | ForEach-Object {
    Set-ADAccountPassword -Identity $_ -Server $Dc -Reset `
      -NewPassword (Read-Host "New password for $($_.Name)" -AsSecureString)
    Set-ADUser -Identity $_ -Server $Dc -ChangePasswordAtLogon $true
  }

# Check again
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -RevealedAccounts

Check the starting state

repadmin /replsummary
repadmin /showrepl $Rodc
nltest /dsgetdc:vmorecloud.com /force

Make sure the RODC reaches a writable DC and replication shows no failures before you change anything.

Reset krbtgt_XXXXX on a writable DC

$krb = (Get-ADComputer $Rodc -Properties msDS-KrbTgtLink).'msDS-KrbTgtLink'
Add-Type -AssemblyName System.Web
$pw  = ConvertTo-SecureString ([System.Web.Security.Membership]::GeneratePassword(64,10)) -AsPlainText -Force
Set-ADAccountPassword -Identity $krb -Server $Dc -Reset -NewPassword $pw

# Replicate and verify
repadmin /syncall $Dc /AdeP
repadmin /replsummary
dcdiag /s:$Rodc /v

Impact: tickets issued by that RODC become invalid, so clients silently re-authenticate. Expect a short blip, longer if the WAN is down. Test a branch logon through the RODC afterwards.

Suspected compromise: after replication completes, reset it a second time. This mirrors the guidance for the domain krbtgt: the second reset invalidates tickets signed with the previous key. Verify the behaviour in your lab.

Reset the computer account password

The RODC needs a reachable writable DC to change its own computer account password, so only do this while the WAN link is up. Run on the RODC in an elevated prompt:

Stop-Service kdc
netdom resetpwd /server:server.vmorecloud.com /userd:vmorecloud\<DOMAIN-ADMIN> /passwordd:*
Restart-Computer

Verify after the restart:

nltest /sc_verify:vmorecloud.com
repadmin /replsummary
dcdiag /s:$Rodc

If this fails, a mismatched secret breaks replication and the RODC cannot authenticate to its partners. Repair the secure channel from a writable DC or rebuild the RODC. Verify this procedure in your lab before using it in production.

Decommission and redeploy

1. Isolate the RODC and power it off.
2. Export what it cached:

   Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -RevealedAccounts |
     Export-Csv C:\rodc-revealed.csv -NoTypeInformation
   Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity $Rodc -AuthenticatedAccounts |
     Export-Csv C:\rodc-authenticated.csv -NoTypeInformation

3. In dsa.msc, delete the RODC computer account from the Domain Controllers OU. The dialog offers to reset passwords for the user and computer accounts cached on it. Tick both. Deleting the account also removes its krbtgt_XXXXX.
4. Clean up DNS records and stale metadata, and remove the server from its site.
5. Check that no privileged account appears in the export. If one does, reset it and investigate.
6. Redeploy with a staged installation, so a fresh RODC with a new krbtgt_XXXXX replaces it.