Additional Active Directory Server Roles - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 506

Figure 12-13

The Password Replication Policy tab

Activity 12-6: Configuring Credential Caching

Time Required: 20 minutes
Objective: Create a group and add it to the PRP of the RODC.
Description: You're getting ready to install an RODC at your branch office. Before doing so, you
want to make sure office users' credentials are cached by the RODC. Your salespeople will also
frequent the branch office and any future branch offices, so you want to make sure their cre-
dentials are cached, too.
1. Log on to Server1XX as Administrator.
2. Open Active Directory Users and Computers, and click the Domain Controllers OU.
3. First, create a new OU and group to represent the branch office users. Click the domain
object, and then click the OU toolbar icon. In the New Object dialog box, type Branch1 and
click OK .
4. Create a new global security group named Branch1-G in the Branch1 OU. User and com-
puter accounts located at the branch office should be added to this group.
5. Click the Users folder. Double-click the Denied RODC Password Replication Group group.
Notice that several groups are already members of this group. These group members' pass-
words aren't replicated to any RODCs in the domain. Click Cancel .
6. Double-click the Allowed RODC Password Replication Group group. Click the Members
tab, and then click Add . In the Select Users, Contacts, Computers, or Groups dialog box, type
Sales-G , click Check Names , and then click OK twice. Now the passwords of all Sales-G
members will be replicated to the RODC.
7. In Active Directory Users and Computers, click the Domain Controllers OU.