Understanding Active Directory Domain Services: A Complete Guide to ADC, RODC, and CDC
Centralized identity and access management is essential for maintaining security and simplifying administration. Here is how the different domain controller types fit into that picture.
What Is Active Directory Domain Services (AD DS)?
Active Directory Domain Services (AD DS) is a Microsoft directory service that stores information about objects within a network and makes this information easily accessible to administrators and users. It provides centralized authentication, authorization and access control, Group Policy management, Single Sign-On (SSO), resource management, and security policy enforcement. The database used by AD DS is stored in the NTDS.dit file, which contains all directory objects and their attributes.
Core Components of AD DS
| Logical Components | Physical Components |
|---|---|
| Forest | Domain Controllers |
| Tree | Sites |
| Domain | Subnets |
| Organizational Unit (OU) | Global Catalog |
| User / Group / Computer Objects | Replication Topology |
What Is a Domain Controller (DC)?
A Domain Controller is a Windows Server that hosts the Active Directory database and provides authentication and directory services — including user and computer authentication, Group Policy distribution, password validation, directory replication, and DNS integration. Organizations often deploy multiple domain controllers to improve redundancy, availability, and performance. Three variants matter most in real deployments: the Additional Domain Controller, the Read-Only Domain Controller, and the Child Domain Controller.
Additional Domain Controller (ADC)
An Additional Domain Controller (ADC) is an extra writable domain controller added to an existing Active Directory domain. It contains a complete copy of the Active Directory database and participates in multi-master replication. Unlike the first domain controller in the domain, an ADC provides redundancy and load balancing while sharing authentication responsibilities — if one domain controller becomes unavailable, users can continue logging in through another.
Why use an ADC: high availability, fault tolerance, load balancing, faster authentication, disaster recovery, and reduced authentication latency.
Features: fully writable Active Directory database, multi-master replication, supports FSMO role transfers, can authenticate users, replicates changes to other domain controllers, and can host DNS if configured.
Read-Only Domain Controller (RODC)
A Read-Only Domain Controller (RODC), introduced with Windows Server 2008, stores a read-only copy of the Active Directory database — it cannot make changes directly to Active Directory. RODCs are commonly deployed in branch offices, remote locations, sites with limited physical security, small offices, and retail stores — environments that may not have dedicated IT staff or secure server rooms.
Features: read-only Active Directory database, optional read-only DNS, credential caching, a Password Replication Policy (PRP), unidirectional replication, and limited administrative delegation.
The Password Replication Policy is one of the most important RODC features: administrators can control which user passwords can be cached, which cannot, and which accounts are allowed to authenticate — significantly improving security in locations where the server itself is at greater physical risk.
Limitations: cannot update Active Directory, cannot originate replication changes, has limited administrative functions, and depends on writable domain controllers for updates.
Child Domain Controller (CDC)
A Child Domain is a domain created beneath a parent domain within the same Active Directory forest. For example, a parent domain company.com might have child domains such as sales.company.com, hr.company.com, or india.company.com — each with its own domain controllers. A Child Domain Controller (CDC) is simply a domain controller that hosts a child domain, managing authentication, authorization, Group Policy, DNS, and Active Directory objects for that specific child domain.
Why create child domains: administrative separation, geographic separation, different password policies, different security boundaries, and delegated administration.
Drawbacks: increased complexity, more replication traffic, additional domain controllers to maintain, and more administrative effort overall.
Comparison: ADC vs RODC vs CDC
| Feature | ADC | RODC | CDC |
|---|---|---|---|
| Writable Database | Yes | No | Yes |
| Authentication | Yes | Yes | Yes |
| Password Changes | Yes | No | Yes |
| Replication | Multi-master | One-way (receives updates) | Multi-master |
| Best Location | Headquarters | Branch Office | Separate Business Unit |
| Security | Standard | High | Standard |
| Administrative Independence | No | No | Yes (within child domain) |
When Should You Use Each?
- Use an ADC when high availability is required, you need load balancing, you want redundancy, or disaster recovery is important.
- Use an RODC when the office has poor physical security, the location is remote, there is no local IT staff, or you want to reduce credential exposure.
- Use a CDC when different departments require separate administration, multiple geographic regions need their own domains, different security or compliance requirements exist, or organizational autonomy is needed.
Use child domains only when there is a genuine administrative or business need — Organizational Units (OUs) often provide sufficient delegation with far less complexity.
Best Practices
- Deploy at least two writable domain controllers for production environments.
- Place RODCs in branch offices where physical security cannot be guaranteed.
- Use child domains only when there is a genuine administrative or business need — OUs are usually the simpler answer.
- Regularly monitor Active Directory replication health.
- Back up system state data on domain controllers.
- Secure domain controllers with appropriate physical and network protections.
Frequently Asked Questions
What is the difference between an ADC and an RODC?
An ADC is a fully writable domain controller used for redundancy and load balancing, typically at headquarters. An RODC holds a read-only copy of Active Directory and is used in locations with weaker physical security, such as branch offices, since it cannot be used to push changes back into the directory.
Why would an organization create a child domain instead of using Organizational Units?
Child domains are used when a business needs genuine administrative separation — such as different security boundaries, different password policies, or full administrative autonomy for a region or business unit — that an Organizational Unit cannot provide. For most delegation needs, OUs are simpler and sufficient.
What is the Password Replication Policy on an RODC?
It is a policy that lets administrators control exactly which user passwords are allowed to be cached on the RODC and which accounts are permitted to authenticate against it, limiting the security impact if the RODC itself is compromised or stolen.
Can an RODC make changes to Active Directory?
No. An RODC holds a read-only copy of the directory and cannot originate replication changes. It depends on writable domain controllers, such as an ADC, for all updates.
Conclusion
ADC, RODC, and CDC solve three different problems: availability at headquarters, security at unprotected remote sites, and administrative separation across business units or regions. Understanding when each one is the right tool — rather than defaulting to the most familiar option — is fundamental to designing a secure, scalable Active Directory infrastructure.
Need help designing or securing your Active Directory infrastructure? Talk to ROSTAN's infrastructure team.
