Test-ADDSReadOnlyDomainControllerAccountCreation
Runs the prerequisites for adding a RODC account.
Syntax
Test-ADDSReadOnlyDomainControllerAccountCreation
-DomainControllerAccountName <String>
-DomainName <String>
-SiteName <String>
[-AllowPasswordReplicationAccountName <String[]>]
[-Credential <PSCredential>]
[-DelegatedAdministratorAccountName <String>]
[-DenyPasswordReplicationAccountName <String[]>]
[-NoGlobalCatalog]
[-InstallDns]
[-ReplicationSourceDC <String>]
[-Force]
[<CommonParameters>] Description
The Test-ADDSReadOnlyDomainControllerAccountCreation cmdlet runs the prerequisite checks which
would be performed if you were to add a read-only domain controller (RODC) account in Active
Directory using the Add-ADDSReadOnlyDomainControllerAccount cmdlet. It differs from using the
WhatIf parameter with the Add-ADDSReadOnlyDomainControllerAccount cmdlet in that instead of
summarizing the changes that would occur during the account creation process, this cmdlet actually
tests whether those changes are possible given the current environment.
Examples
Example 1: Test adding an RODC account to confirm it is possible
$HashArguments = @{
DomainControllerAccountName = RODC1
DomainName = "corp.contoso.com"
SiteName = "NorthAmerica"
}
Test-ADDSReadOnlyDomainControllerAccountCreation @HashArgumentsThis command runs the prerequisites for adding an RODC account to the corp.contoso.com domain that
would use the North America site as the source site for the replication source domain controller.
Parameters
-AllowPasswordReplicationAccountName
Specifies the names of user accounts, group accounts, and computer accounts whose passwords can be
replicated to this RODC. Use None if you want to keep the value empty. By default, only the
Allowed RODC Password Replication Group is allowed, and it is originally created empty.
| Type: | String[] |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Credential
Specifies the user name and password that corresponds to the account used to install the domain
controller. Use the Get-Credential cmdlet to prompt the user to supply a password.
| Type: | PSCredential |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DelegatedAdministratorAccountName
Specifies the name of the user or group that installs and administer the RODC.
| Type: | String |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DenyPasswordReplicationAccountName
Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not
to be replicated to this RODC. Use None if you do not want to deny the replication of credentials
of any users or computers. By default, Administrators, Server Operators, Backup Operators, Account
Operators, and the Denied RODC Password Replication Group are denied. By default, the Denied RODC
Password Replication Group includes Cert Publishers, Domain Admins, Enterprise Admins, Enterprise
Domain Controllers, Enterprise Read-Only Domain Controllers, Group Policy Creator Owners, the
krbtgt account, and Schema Admins.
| Type: | String[] |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DomainControllerAccountName
Specifies the name of the RODC account that this cmdlet creates.
| Type: | String |
| Position: | Named |
| Default value: | <mandatory> |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DomainName
Specifies the domain name for the user name for the operation. This parameter is required. You should specify the forest where you plan to install the domain controller or create an RODC account.
| Type: | String |
| Position: | Named |
| Default value: | <mandatory> |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Force
Forces the command to run without asking for user confirmation.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-InstallDns
Indicates that the cmdlet installs the DNS Server service. The default is automatically computed based on the environment.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-NoGlobalCatalog
Indicates that the RODC is not a global catalog server.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ReplicationSourceDC
Specifies the name of the fully writable domain controller to use in the creation of the RODC account in Active Directory.
| Type: | String |
| Position: | Named |
| Default value: | NULL |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SiteName
Specifies the name of an existing site where you can place the new domain controller. The default
value depends on the type of installation. For a new forest, the default is
Default-First-Site-Name. For all other installations, the default is the site that is associated
with the subnet that includes the IP address of this server. If no such site exists, the default is
the site of the replication source domain controller.
| Type: | String |
| Position: | Named |
| Default value: | <mandatory> |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |