Question
Your network contains a two-domain on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.
All domain controllers are backed up by using Azure Backup.
You create an Active Directory site named Site3. Site1, Site2, and Site3 each has a dedicated site link to the Hub site.
In Site3, you install a new server named Server1.
You need to promote Server1 to an RODC in child.contoso.com by using the Install from Media (IFM) option. The solution must minimize network traffic.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
| Name | Description | Domain | Active Directory site |
| --- | --- | --- | --- |
| DC1 | Forest-wide and domain-wide FSMO role holder | contoso.com | Hub |
| DC2 | Domain-wide FSMO role holder | child.contoso.com | Site1 |
| RODC3 | Read-only domain controller (RODC) | contoso.com | Site2 |
Explanation
Server to use to create the IFM source: DC2. Install from Media must use media taken from a domain controller in the same domain as the new domain controller. Server1 will become an RODC in child.contoso.com. DC2 is the only domain controller in that domain and it is writable, so its media lets Server1 be promoted with little replication traffic across the site links. DC1 and RODC3 belong to the contoso.com domain, so their databases cannot seed a domain controller for child.contoso.com. Server1 is not yet a domain controller and has no directory database to export.
Tool to use to create the IFM source: Ntdsutil.exe. You run ntdsutil, then 'activate instance ntds', 'ifm', and 'create sysvol rodc <folder>' (or 'create rodc'). This exports the directory database, plus SYSVOL if requested, in the form the AD DS installation wizard expects, and it strips cached secrets such as passwords from RODC media. Azure Backup produces cloud recovery points, not IFM media. Dcdiag.exe and Repadmin.exe are diagnostic and replication tools that cannot create installation media. Windows Server Backup does not prepare the dedicated, secret-free RODC media that the ifm create rodc command produces.
