WINDOWS SERVER 2025 • ACTIVE DIRECTORY • AZ-802 LAB

Staged RODC Installation with Delegated Administration on Windows Server

Pre-create a Read-Only Domain Controller account in vmorecloud.com, hand the installation to a non-privileged branch administrator, and verify replication, the Password Replication Policy and RODC status.

Author: Khurram Shahzad

Platform: Windows Server 2025

Technology: Active Directory Domain Services

Management: ADUC & PowerShell

Level: Advanced

Reading Time: 20 minutes

Stage centrally, install locally, trust nobody with Domain Admin

In a staged installation a Domain Admin creates the RODC account at the hub. A branch technician then attaches the server using only a delegated, non-privileged account. No domain admin credential ever reaches the branch.

RODC

What this tutorial coversWhy and when to stage an RODC, prerequisites, pre-creating the account with Active Directory Users and Computers (ADUC) or PowerShell, attaching the server with Install-ADDSDomainController -UseExistingAccount -ReadOnlyReplica, what the delegated administrator can and cannot do, and verification with dcdiag and repadmin.

Two roles, two people

A Domain Admin stages the account. A branch admin with no domain rights completes the install.

Names must match

The server name must equal the staged account name, and the server must not be domain-joined yet.

Policy set at staging

The Password Replication Policy and the delegated administrator are defined before the server exists.

Purpose, security rationale and lab assumptions

A Read-Only Domain Controller (RODC) holds a read-only copy of the Active Directory Domain Services (AD DS) database. It pulls changes from a writable domain controller (DC), never replicates changes outward, and caches only the passwords that its Password Replication Policy (PRP) allows. If a branch server is stolen or tampered with, the attacker gets a limited credential set and no way to write bad data back into the forest.

A staged installation splits the work in two. A Domain Admin pre-creates the RODC computer account at headquarters, defining its site, PRP and delegated administrator. Later, a local technician, who belongs only to the delegated group, runs the promotion on the branch server and attaches it to that account. Use it when:

Branch staff must install the server but must never hold Domain Admin credentials.
The branch link is slow or unreliable and you want the policy decisions made centrally beforehand.
You need an auditable, repeatable process for many branches.

Lab assumptions

Version: your input label for the Windows Server version was not recognisable, so this guide uses Windows Server 2025 consistently. Staged RODC installation has been available since Windows Server 2008, and the ADDSDeployment PowerShell cmdlets used here since Windows Server 2012. Version differences are noted where they matter.
Network: the lab subnet is 192.168.91.0/24, mask 255.255.255.0, gateway 192.168.91.2. The address 192.168.91.129 is the existing writable DC server.vmorecloud.com, which is also the DNS server.
RODC address: because .129 is already taken by the writable DC, the example RODC uses 192.168.91.135. Replace it with any free address.
Domain: vmorecloud.com, NetBIOS name detected with (Get-ADDomain).NetBIOSName.

Setting	Writable DC (existing)	RODC (new)
Hostname	`server.vmorecloud.com`	<RODC-HOSTNAME> (example: RODC1)
IP address	`192.168.91.129`	<RODC-IP> (example: `192.168.91.135`)
DNS server	itself	`192.168.91.129` until promotion completes
Site	Default-First-Site-Name	<BRANCH-SITE>

Prerequisites and placeholders

Functional levels: forest functional level of at least Windows Server 2003. For a Windows Server 2025 RODC, confirm the minimum levels in Microsoft’s documentation for your version.
Writable DCs: at least one writable DC in the domain running Windows Server 2008 or later, with the PDC emulator on Windows Server 2008 or later. If the forest was never prepared for RODCs, run adprep /rodcprep once as an Enterprise Admin.
DNS: AD-integrated DNS on the writable DC. The RODC runs the DNS Server role with read-only zone copies.
Site and subnet: an AD site for the branch with a site link to the hub (created below).
Accounts for staging: a Domain Admins account to create the RODC account and set the PRP.
Accounts for the install: a delegated administrator group containing the branch technician. The technician needs no domain privileges, but must be a local administrator on the target server.
Target server: Windows Server 2025, static IP, workgroup member (not domain-joined) and renamed to exactly the staged account name.

Placeholder	What to substitute
<RODC-HOSTNAME>	The RODC computer account and server name, up to 15 characters, for example `RODC1`.
<RODC-IP>	Static IPv4 address of the RODC, for example `192.168.91.135`.
<BRANCH-SITE>	AD site name for the branch, for example `Branch-Office-1`.
<DOMAIN-ADMIN>	A Domain Admins account used only for staging, for example `vmorecloud\Administrator`.
<RODC-ADMIN-GROUP>	A global security group that will be the delegated administrators of this RODC.
<BRANCH-ADMIN>	The branch technician’s user account, a member of <RODC-ADMIN-GROUP> and not a Domain Admin.
<BRANCH-ALLOWED-GROUP>	Group of branch users and computers whose passwords may be cached on the RODC.
<DSRM-PASSWORD>	A new strong Directory Services Restore Mode (DSRM) password, typed at a prompt and stored in a password vault.

Check the forest (run on server.vmorecloud.com)

Get-ADForest | Select-Object Name, ForestMode
Get-ADDomain | Select-Object DNSRoot, DomainMode, NetBIOSName
netdom query fsmo
Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem, IsReadOnly

dcdiag /e /q
repadmin /replsummary

Resolve any DNS or replication failure first. Only if the forest was never prepared for RODCs, run adprep /rodcprep on the schema master as an Enterprise Admin.

Prepare the site, subnet and groups

Create the branch site and site link

Server Manager → Tools → Active Directory Sites and Services

New-ADReplicationSite -Name "<BRANCH-SITE>"

New-ADReplicationSiteLink -Name "HQ-to-<BRANCH-SITE>" `
  -SitesIncluded "Default-First-Site-Name", "<BRANCH-SITE>" `
  -Cost 100 -ReplicationFrequencyInMinutes 15

Get-ADReplicationSite -Filter * | Select-Object Name
Get-ADReplicationSiteLink -Filter * | Select-Object Name, Cost, ReplicationFrequencyInMinutes

Subnet in the lab versus productionAn AD subnet maps to exactly one site. In production, give the branch its own subnet and map it with New-ADReplicationSubnet -Name "<BRANCH-SUBNET>" -Site "<BRANCH-SITE>". In this lab the whole 192.168.91.0/24 range, which contains 192.168.91.129, stays on the hub site. The RODC is still placed in <BRANCH-SITE> explicitly by the staged account, so the replication design is the same.

Create the delegated administrator group and the allowed group

# Delegated administrators of this RODC: NOT members of Domain Admins
New-ADGroup -Name "<RODC-ADMIN-GROUP>" -GroupScope Global -GroupCategory Security `
  -Description "Local administrators of the branch RODC"
Add-ADGroupMember "<RODC-ADMIN-GROUP>" -Members <BRANCH-ADMIN>

# Accounts whose passwords may be cached on this RODC
New-ADGroup -Name "<BRANCH-ALLOWED-GROUP>" -GroupScope Global -GroupCategory Security
Add-ADGroupMember "<BRANCH-ALLOWED-GROUP>" -Members user1, user2

Never add privileged accounts to the allowed group. A privileged account that is also in a denied group is still denied, because deny always wins.

Pre-stage the RODC account

Option A: Active Directory Users and Computers

ADUC → vmorecloud.com → Domain Controllers → right-click → Pre-create Read-only Domain Controller account…

On the welcome page, leave Use advanced mode installation ticked so the PRP and delegation pages appear, and click Next.
Network Credentials: use the current logon, or alternate credentials with <DOMAIN-ADMIN>.
Specify the Computer Name: enter <RODC-HOSTNAME>. The server must later carry exactly this name.
Select a Site: choose <BRANCH-SITE>.
Additional Domain Controller Options: keep DNS server and Global Catalog ticked.
Password Replication Policy: leave the default denied groups (Administrators, Server Operators, Backup Operators, Account Operators and Denied RODC Password Replication Group). Click Add, choose Allow passwords for the account to replicate to this RODC and select <BRANCH-ALLOWED-GROUP>.
Delegation of RODC Installation and Administration: click Set and select <RODC-ADMIN-GROUP>. This group can attach the server and becomes its local administrators.
Review the summary and click Finish. The account appears in the Domain Controllers OU as an Unoccupied domain controller account.

Option B: PowerShell

$cred = Get-Credential <DOMAIN-ADMIN>
$nb   = (Get-ADDomain).NetBIOSName

# Dry run: validates names, site and permissions without creating anything
Test-ADDSReadOnlyDomainControllerAccountCreation `
  -DomainControllerAccountName "<RODC-HOSTNAME>" `
  -DomainName "vmorecloud.com" `
  -SiteName "<BRANCH-SITE>" `
  -DelegatedAdministratorAccountName "$nb\<RODC-ADMIN-GROUP>" `
  -Credential $cred

# Create the staged RODC account
Add-ADDSReadOnlyDomainControllerAccount `
  -DomainControllerAccountName "<RODC-HOSTNAME>" `
  -DomainName "vmorecloud.com" `
  -SiteName "<BRANCH-SITE>" `
  -DelegatedAdministratorAccountName "$nb\<RODC-ADMIN-GROUP>" `
  -AllowPasswordReplicationAccountName @("$nb\<BRANCH-ALLOWED-GROUP>") `
  -DenyPasswordReplicationAccountName @("BUILTIN\Administrators","BUILTIN\Server Operators","BUILTIN\Backup Operators","BUILTIN\Account Operators","$nb\Denied RODC Password Replication Group") `
  -InstallDns:$true `
  -NoGlobalCatalog:$false `
  -Credential $cred

The deny list shown equals the default; writing it out makes the protection visible. Run Get-Help Add-ADDSReadOnlyDomainControllerAccount -Full to confirm parameters on your build.

Confirm the staged account

Get-ADComputer "<RODC-HOSTNAME>" -Properties ManagedBy, msDS-isRODC, msDS-RevealOnDemandGroup, msDS-NeverRevealGroup |
  Select-Object Name, DistinguishedName, ManagedBy, msDS-isRODC

Get-ADDomainControllerPasswordReplicationPolicy -Identity "<RODC-HOSTNAME>" -Allowed
Get-ADDomainControllerPasswordReplicationPolicy -Identity "<RODC-HOSTNAME>" -Denied

msDS-isRODC should be True and ManagedBy should point at <RODC-ADMIN-GROUP>. The account exists but no server is attached yet.

Promote the target server with the staged account

These steps are performed at the branch by <BRANCH-ADMIN>, a member of <RODC-ADMIN-GROUP> with no domain rights.

Prepare the server: workgroup, name, IP, DNS and time

$if = (Get-NetAdapter | Where-Object Status -eq 'Up' | Select-Object -First 1).Name

Set-NetIPInterface -InterfaceAlias $if -Dhcp Disabled
New-NetIPAddress -InterfaceAlias $if -IPAddress <RODC-IP> -PrefixLength 24 -DefaultGateway 192.168.91.2
Set-DnsClientServerAddress -InterfaceAlias $if -ServerAddresses 192.168.91.129

# Name must equal the staged account; do NOT join the domain
Rename-Computer -NewName "<RODC-HOSTNAME>" -Restart

After the restart, verify the connection and clock against the writable DC at 192.168.91.129:

Resolve-DnsName vmorecloud.com -Server 192.168.91.129
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.vmorecloud.com -Server 192.168.91.129
w32tm /stripchart /computer:192.168.91.129 /samples:3 /dataonly
Test-NetConnection 192.168.91.129 -Port 389
(Get-CimInstance Win32_ComputerSystem) | Select-Object Name, PartOfDomain

PartOfDomain must be False. Then install the roles:

Install-WindowsFeature -Name AD-Domain-Services, DNS -IncludeManagementTools

Attach the server to the staged account

GUI path: Server Manager → yellow flag → Promote this server to a domain controller, choose Add a domain controller to an existing domain, enter vmorecloud.com, and supply the <BRANCH-ADMIN> credentials. The wizard detects the staged account and offers Use existing RODC account; enter the DSRM password and finish.

PowerShell:

# Credentials of the delegated branch admin, NOT a Domain Admin
$cred = Get-Credential vmorecloud\<BRANCH-ADMIN>
$dsrm = Read-Host "Enter <DSRM-PASSWORD>" -AsSecureString

# Dry run
Test-ADDSDomainControllerInstallation `
  -DomainName "vmorecloud.com" `
  -Credential $cred `
  -UseExistingAccount:$true `
  -ReadOnlyReplica:$true `
  -SafeModeAdministratorPassword $dsrm

# Attach and promote
Install-ADDSDomainController `
  -DomainName "vmorecloud.com" `
  -Credential $cred `
  -UseExistingAccount:$true `
  -ReadOnlyReplica:$true `
  -ReplicationSourceDC "server.vmorecloud.com" `
  -SafeModeAdministratorPassword $dsrm `
  -Force:$true

The site, DNS, Global Catalog and PRP settings are read from the staged account, so they are not repeated here. If PowerShell reports that -ReadOnlyReplica conflicts with -UseExistingAccount on your build, remove -ReadOnlyReplica; the account is already read-only. The server restarts when promotion finishes, then replicates from 192.168.91.129.

Older Windows Server versionsThe same attach is possible on Windows Server 2008 and 2008 R2 with dcpromo /UseExistingAccount:Attach. The ADDSDeployment cmdlets above require Windows Server 2012 or later.

Delegated administration

RODC administrator role separation lets a group manage one RODC as a local administrator without any rights in the domain. The delegation is stored in the managedBy attribute of the RODC account and applied as local Administrators membership on the RODC.

The delegated group CAN	The delegated group CANNOT
Log on locally and by Remote Desktop to the RODC	Change objects on writable DCs or in other domain partitions
Install updates, drivers and software	Modify the PRP or add accounts to the allowed list
Start, stop and configure services, and restart the server	Log on to or administer other domain controllers
Back up and manage local files and the local firewall	Reset domain account passwords or manage Domain Admins
Attach the staged server and remove the RODC role	Gain any privileged group membership in the domain

Configure or change the delegated administrator

The delegation was set while staging. To check or change it later, run the following as a Domain Admin:

# Show and set the delegated group (Managed By)
(Get-ADComputer "<RODC-HOSTNAME>" -Properties ManagedBy).ManagedBy
Set-ADComputer "<RODC-HOSTNAME>" -ManagedBy "<RODC-ADMIN-GROUP>"

GUI path: ADUC → Domain Controllers → RODC → Properties → Managed By. To grant local-admin rights on the RODC itself, use dsmgmt on the RODC:

dsmgmt
local roles
add vmorecloud\<RODC-ADMIN-GROUP> Administrators
show role Administrators
quit
quit

Test as <BRANCH-ADMIN> on the RODC: whoami /groups should show local Administrators, and Get-ADGroupMember "Domain Admins" must not list this user.

Verification

Confirm RODC status

Get-ADDomainController -Identity "<RODC-HOSTNAME>" | Select-Object Name, IsReadOnly, Site, IPv4Address, IsGlobalCatalog
Get-ADDomainController -Filter {IsReadOnly -eq $true} | Select-Object Name, Site

In ADUC the account now shows DC Type: Read-only instead of Unoccupied.

Check replication with repadmin and health with dcdiag

repadmin /replsummary
repadmin /showrepl <RODC-HOSTNAME>
repadmin /syncall /AdeP

dcdiag /s:<RODC-HOSTNAME> /v
dcdiag /s:<RODC-HOSTNAME> /test:dns /v

On an RODC repadmin /showrepl shows inbound partners only, which confirms one-way replication. Failures must be 0 and each dcdiag test must pass. DNS tests may need a few minutes after the first restart.

Check the Password Replication Policy and DNS records

Get-ADDomainControllerPasswordReplicationPolicy -Identity "<RODC-HOSTNAME>" -Allowed
Get-ADDomainControllerPasswordReplicationPolicy -Identity "<RODC-HOSTNAME>" -Denied

# Optional: cache a branch user, then list what is cached
repadmin /rodcpwdrepl <RODC-HOSTNAME> server.vmorecloud.com "CN=user1,CN=Users,DC=vmorecloud,DC=com"
Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity "<RODC-HOSTNAME>" -RevealedAccounts

# DC locator records and host record
Resolve-DnsName -Type SRV _ldap._tcp.<BRANCH-SITE>._sites.dc._msdcs.vmorecloud.com -Server 192.168.91.129
Resolve-DnsName <RODC-HOSTNAME>.vmorecloud.com -Server 192.168.91.129

Privileged accounts such as Domain Admins must never appear in the revealed list.

Common problems

Symptom	Cause and fix
Wizard does not offer the staged account	The server name does not match the account, or the server is already domain-joined. Rename to the exact account name and leave the domain.
“The specified domain either does not exist or could not be contacted”	DNS on the server does not point to `192.168.91.129`. Fix the DNS client address and flush the cache.
Access denied during promotion	The user is not in <RODC-ADMIN-GROUP>, or is not a local administrator on the target. Check `(Get-ADComputer RODC1 -Properties ManagedBy).ManagedBy`.
Replication fails (1722 or 8524)	RPC ports or DNS blocked. Open TCP 135, 389, 445, 88, 464 and 49152-65535 to the writable DC and re-run `repadmin /syncall /AdeP`.
Kerberos or clock errors	Time skew above 5 minutes. Run `w32tm /resync /force` and check hypervisor time sync.

Frequently asked questions

Can I change the PRP after staging?

Yes, a Domain Admin can edit it at any time with Add-ADDomainControllerPasswordReplicationPolicy or the RODC properties in ADUC. The delegated administrator cannot.

Does the staged account expire?

No fixed expiry applies, but delete unused staged accounts so they cannot be claimed by an unintended server.

Can the delegated admin be a single user instead of a group?

Yes, but a group makes staff changes easier and is easier to audit.

Conclusion

You staged an RODC account centrally, let a non-privileged branch administrator attach the server, and verified that replication, the PRP and RODC status are correct.

Staged RODC checklist

Forest prerequisites met and a writable DC (Windows Server 2008 or later) available at 192.168.91.129
Branch site and site link exist; RODC account placed in <BRANCH-SITE>
Staged account shows msDS-isRODC = True and the correct ManagedBy
Target server was a workgroup member with the exact account name and DNS pointing at 192.168.91.129
Promotion ran with -UseExistingAccount and a non-Domain-Admin credential
Delegated group has local admin rights on the RODC and no Domain Admin membership
repadmin /replsummary shows 0 failures and dcdiag passes
PRP allows only branch accounts; privileged accounts remain denied and are not in the revealed list
DSRM password stored securely

Next: protect local administrator passwords

With the RODC in place, continue the AZ-802 lab series with Windows LAPS on VMoreCloud.

Sources & Further Reading

👤 About the Author

Khurram Shahzad

Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware (VCF, vSAN, Aria), Microsoft Azure, AWS, Windows Server, Microsoft 365, Entra ID, Intune, Linux, Nutanix, Proxmox, networking, backup & disaster recovery, Cisco and FortiGate. I share practical technical guides, infrastructure projects and insights to help IT professionals build and manage modern IT environments through VMoreCloud.

🖥️ VMware🔷 Azure☁️ AWS🪟 Windows Server🐧 Linux🗄️ Virtualization🛡️ Cybersecurity🔗 Networking💾 Backup & DR✖️ Nutanix🟠 Proxmox

📄

120+

Articles Published

👥

10K+

Readers

🎓

Learning & Sharing

A Stronger Tech Community

View all articles →

“Learn | Build | Share”

☁️ VMoreCloud|Tech Knowledge for a Better Tomorrow

IT • Cloud • Virtualization • Security • Open Source

Technical note: commands were written for Windows Server 2025 in the vmorecloud.com lab. Test in a lab before production and replace all highlighted placeholders with your own values.