Active Directory Domain Services 2008 : Automatically Move Accounts That Have Been Authenticated by an RODC to the Allowed List

3/20/2011 11:43:20 AM

Use repadmin /prp to automatically add these accounts to the Allowed List for the Password Replication Policy on the RODC.

To automatically move accounts that have been authenticated by an RODC to the allowed list, perform the following steps:

Log on to a writable domain controller that has Windows Server 2008 installed.

Click Start, and click Command Prompt.

In the Command Prompt window, type the following command and press Enter:

repadmin /prp move WS08RODC1.WS08DOMAIN01.local "WS08RODC1
							On-Demand"

Table 1 lists each parameter used in the previous command.

Table 1. Parameters to Automatically Move Accounts That Have Been Authenticated by an RODC to the Allowed List
Parameter	Meaning
WS08R0DC1.WS08DOMAIN01.local	Fully qualified domain name (FQDN) of RODC
"WS08RODC1 On-Demand"	The group name to be created in which to store the accounts

Tip

On the confirmation to move all security principals from the Auth2 list of the RODC to the Allow list, shown in Figure 1, type Y.

On the confirmation page to create the AD DS group, shown in Figure 2, type Y.

Verify the command completed successfully, as shown in Figure 3.

Other -----------------