Share via

3.3.5.7.7 Read-only Domain Controller (RODC)

  • Article

When a Key Distribution Center (KDC) which is a read-only domain controller (RODC) receives:

  • An AS-REQ message with a PA-PAC-OPTIONS [167] (section 2.2.10) padata type with the forward to full DC bit set, the RODC forwards the AS-REQ to a full DC.

  • A TGS-REQ message with a PA-PAC-OPTIONS [167] (section 2.2.10) padata type with the Branch Aware bit set, and the application server (sname) is not in its database, the RODC returns server principal unknown with the substatus message of NTSTATUS STATUS_NO_SECRETS ([MS-ERREF] section 2.3.1).