Finding Filter Attribute Set of RODC in Active Directory

Hello,

By design, Read Only Domain controllers does not replicate all attributes, those which aren’t replicate are called “Filter Attribute Set” (FAS), you can find them with that PowerShell example :

$dse = [adsi]“LDAP://RootDSE”
$SchemaPart=$dse.schemaNamingContext
$RODCFASSearcher=[ADSISearcher]”(searchFlags:1.2.840.113556.1.4.803:=512)”
$RODCFASSearcher.SearchRoot=[adsi]”LDAP://$SchemaPart”
$RODCFASSearcher.FindAll() | Select-Object -ExpandProperty Path | % {($_ -split “,”)[0]} | % {($_ -split “=”)[1]} | Sort-Object

Leave a Reply