Question
Your network contains a single domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains a single Active Directory site.
You plan to deploy a read only domain controller (RODC) to a new datacenter on a server named Server1. A user named User1 is a member of the local Administrators group on Server1.
You need to recommend a deployment plan that meets the following requirements:
• Ensures that a user named User1 can perform the RODC installation on Server1
• Ensures that Server1 is in a new site named RemoteSite1
• Uses the principle of least privilege
Which three actions should you recommend performing in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Explanation
1. Create a site and a subnet: Server1 must end up in a new site named RemoteSite1. Staging an RODC account asks you to pick an existing site (the Select a Site page, or -SiteName in Add-ADDSReadOnlyDomainControllerAccount, which does not create sites), so RemoteSite1 and its subnet must exist first. The forest already has the DEFAULTIPSITELINK site link, so you do not need to create a new one.
2. Pre-create an RODC account: a Domain Admin stages the RODC computer account in RemoteSite1 and names User1 as the delegated administrator, the group or user allowed to attach the server to the account.
3. Instruct User1 to run the Active Directory Domain Services installation Wizard on Server1: User1 completes the second stage (attach to the existing RODC account) with only the delegated rights. Adding User1 to Contoso\Administrators would give far more privilege than needed, which breaks the least-privilege requirement.
