AD-DCD-03: Read-only domain controller count should be retrievable


ID	`AD-DCD-03`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain controllers
Security area	Infrastructure hardening
Resource type	DomainController
Reads from	On-premises Active Directory

What this checks and how to fix it

Read-Only Domain Controllers (RODCs) are a critical security feature introduced in Windows Server 2008 designed specifically for deployment in locations where physical security cannot be guaranteed, such as branch offices. RODCs provide several security benefits:

Reduced attack surface: RODCs maintain a read-only copy of the Active Directory database, preventing directory modifications from compromised locations
Credential caching control: Administrators can configure which credentials (if any) are cached on the RODC, limiting exposure if the server is compromised
Read-only DNS: RODCs can host read-only DNS zones, reducing DNS poisoning risks
Filtered attribute set: Sensitive attributes can be prevented from replicating to RODCs

Understanding your RODC deployment helps ensure:

Appropriate placement in less secure locations
Proper credential caching policies
Compliance with security standards for branch office infrastructure

Control Type

Operational

Security Recommendation

Deploy RODCs in branch offices: Use RODCs instead of writable DCs in locations with limited physical security
Configure credential caching: Limit cached credentials to only those needed for local operations
Monitor RODC replication: Regularly audit what data is being replicated to RODCs
Plan for RODC compromise: Have procedures in place for quickly resetting passwords if an RODC is compromised
Review RODC placement: Ensure all RODCs are justified and necessary

How the Test Works

This test retrieves all domain controllers and identifies which are configured as Read-Only Domain Controllers. The test reports:

Total number of domain controllers
Number of writable domain controllers
Number of read-only domain controllers (RODCs)
Names and sites of RODCs (if any exist)

Test-MtAdDcNonGlobalCatalogCount - Checks Global Catalog configuration
Test-MtAdDcSiteCoverageCount - Analyzes DC distribution across sites
Test-MtAdSiteWithoutDcCount - Identifies sites without DC coverage

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).