Verify if your Active Directory Schema has RODC extension


Since Windows Server 2008, Microsoft release Read Only Domain Controllers, but those require a schema extension for old schema version. Whatever schema version you use, you can see if it contains the RODC extension by looking in the “ForestUpdates” container in the configuration partition :


You can also use those PowerShell lines :

$RodcPrepared = [ADSI]"LDAP://CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,CN=Configuration,DC=$([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Name -replace '[.]',',DC=')"
if($ -eq "ActiveDirectoryRodcUpdate"){$IsRodcPrepared = $true}else{$IsRodcPrepared=$false}


Leave a Reply