Read-Only Domain Controllers (RODC): Promises, Limits, and Forensic Reality

The RODC Security Promise

The Read-Only Domain Controller (RODC) was engineered for branch office locations lacking physical security guarantees (e.g., warehouses, field sites, retail stores).

By default, zero user passwords are stored on the RODC. Passwords are only cached if the identity is explicitly authorized by the Password Replication Policy (PRP).

Concept

Introduced in Windows Server 2008, the Read-Only Domain Controller (RODC) hosts read-only replicas of Active Directory directory partitions:

1. Read-Only NTDS Database: Applications and administrators cannot commit directory modifications on the RODC; write operations are forwarded via LDAP referrals to a standard Writable Domain Controller (RWDC).
2. Isolated KDC and Dedicated krbtgt Account: Each RODC possesses a distinct, dedicated krbtgt account (named krbtgt_XXXXX), ensuring that compromise of an RODC does not permit forging Golden Tickets across the rest of the enterprise.
3. Password Replication Policy (PRP): A strict access control list defining which accounts are permitted to have their credential hashes cached on the local RODC (Allowed List vs Denied List).

---

Why It Matters in DFIR

When responding to an incident at a branch office hosting an RODC:

• Blast Radius Containment: If an adversary physically steals the RODC server or dumps its ntds.dit file, they acquire only the credential hashes of locally cached accounts. High-privilege administrative groups (Domain Admins, Enterprise Admins) reside in the default Denied List and are never cached on an RODC.
• Surgical Credential Remediation: The RWDC maintains an authoritative record of every identity whose secret was replicated to that RODC (via the msDS-RevealedUsers attribute). Incident responders know exactly which accounts must be rotated without forcing an enterprise-wide password reset.
• Targeted krbtgt_XXXXX Revocation: Rotating the domain’s primary krbtgt account is completely unnecessary during an isolated RODC breach: only the specific krbtgt_XXXXX account tied to that RODC must be rotated or deleted.

---

How It Works

The Password Replication Policy (PRP) and Authentication Workflow

Branch Client Workstation                         RODC                          Hub RWDC
         │                                         │                                  │
         │ 1. TGT-REQ                              │                                  │
         ├────────────────────────────────────────►│                                  │
         │                                         │ 2. Is hash cached locally?       │
         │                                         │    -> NO                         │
         │                                         │ 3. Forward request               │
         │                                         ├─────────────────────────────────►│
         │                                         │                                  │ 4. Validate credentials
         │                                         │                                  │    Evaluate PRP
         │                                         │ 5. Return TGT + Hash (if allowed)│
         │                                         │◄─────────────────────────────────┤
         │                                         │ 6. Cache hash (PRP Allowed)      │
         │◄────────────────────────────────────────┤                                  │
         │ 7. Return TGT signed by krbtgt_XXXXX    │                                  │

1. Default Denied List Blocks All Privileged Principals:
   • Enterprise Admins, Domain Admins, Administrators, Backup Operators, Account Operators, Server Operators.
   • All domain controller computer accounts (Domain Controllers).
2. Allowed List Encompasses Local Branch Personas:
   • Typically a designated group such as Branch-Office-Users representing physical staff on site.

---

What Is Possible

• Extracting the Exact Inventory of Exposed Credentials: Inspecting msDS-RevealedUsers on the RWDC returns all accounts whose credentials were cached on the compromised RODC.
• Issuing Locally Authoritative TGTs: The RODC KDC encrypts TGTs using its own krbtgt_XXXXX key, accepted across the forest because the key is mirrored on RWDCs.
• Delegating Local RODC Administration: A branch technician can be granted local administrator rights over the RODC OS without possessing any rights over the Active Directory directory.

---

What Is Not Possible

• Forging Domain-Wide Golden Tickets from an RODC: The krbtgt_XXXXX key is only accepted for accounts permitted by the PRP. A ticket forged for Domain Admins using this key is rejected by writable DCs.
• Direct Directory Writes on the RODC: LDAP write attempts return LDAP_REFERRAL directing the client to an RWDC.
• Caching Domain Admins Credentials Under Default Policies: Even if an administrator attempts to add an admin into the Allowed List, the Denied List takes precedence during PRP evaluation.

---

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”The adversary extracted ntds.dit from the RODC, therefore the entire enterprise domain is compromised.”	False. An RODC ntds.dit contains only credential hashes permitted by the PRP and actively cached.
”We must reset the primary domain krbtgt account after an RODC theft.”	Unnecessary. Only the specific krbtgt_XXXXX account belonging to the stolen RODC must be revoked.
”An attacker can invoke DCSync against an RODC.”	An RODC does not possess replication secrets for arbitrary principals and cannot fulfill DCSync requests.

---

Concrete Forensic Example

A physical burglary occurs at a regional branch in Lyon. The physical server hosting RODC-LYON is stolen:

1. The DFIR team connects to the headquarters RWDC.
2. Executing PowerShell: Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity "RODC-LYON" -Revealed
3. Output lists 42 local employee accounts and 2 local print service accounts.
4. Zero Tier 0 or enterprise administrative accounts appear in the list.
5. Remediation Executed:
   • Immediate password rotation for the 44 revealed identities.
   • Deletion of the RODC-LYON computer object (automatically purging krbtgt_12894).
   • Headquarters domain remains entirely secure with zero operational disruption.

---

Key Forensic Artefacts

1. Active Directory Attributes (on RWDC):
   • msDS-RevealedUsers: SIDs of identities cached on the RODC.
   • msDS-KrbTgtLinkBl: Pointer to the associated krbtgt_XXXXX account.
2. RWDC Security Event Logs:
   • Event ID 4929: RODC password replication policy change.
   • Event ID 4930: Secret replicated to an RODC.
3. RODC Security Event Logs:
   • Event ID 4768: Local TGT issued by krbtgt_XXXXX.

---

Investigation Methods

1. Extract Revealed Users from Central RWDC: Run Get-ADDomainControllerPasswordReplicationPolicyUsage -Revealed targeting an RWDC.
2. Audit PRP Configuration Integrity: Verify that administrative groups remain firmly enclosed in the PRP Denied List.
3. Revoke the Dedicated RODC KDC Secret: Delete the orphaned RODC computer account to invalidate its associated krbtgt_XXXXX principal.

---

Investigative Tooling

• PowerShell AD Module:

  # List accounts cached on the RODC
  Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity "RODC01" -Revealed |
    Select-Object SamAccountName, DistinguishedName
  
  # Audit PRP configuration
  Get-ADDomainControllerPasswordReplicationPolicy -Identity "RODC01"

• Repadmin:

  repadmin /prp view RODC01
  repadmin /prp query RODC01 revealed

---

Key Takeaways

• RODCs isolate branch locations by limiting the credential footprint on disk and in memory.
• Administrative groups are strictly excluded from replication by default.
• Each RODC operates with a dedicated krbtgt_XXXXX key, preventing global Golden Ticket forgery.
• The msDS-RevealedUsers attribute provides a verifiable forensic boundary in the event of hardware theft.

---

References & Further Reading

• Microsoft Learn: Read-Only Domain Controller Planning and Deployment
• Card 03 — Built-in Accounts and Privileged Accounts
• Card 26 — DCSync: Mechanics, Prerequisites, and Forensic Artefacts
• Card 27 — Golden Ticket vs Silver Ticket: Creation, Scope, and Detection
• Card 28 — Domain Controllers as Lateral Movement Hubs