Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients and for Windows Vista

You do not necessarily have to apply this update before you can deploy a read-only domain controller. Sometimes, compatibility issues do not affect your deployment. Or, you may be able to use a workaround instead of applying the update.

The following sections describe the following items:

• The symptom that is associated with each compatibility issue
• The RODC deployment scenario in which the issue occurs and the clients that are affected by the issue
• The issue's influence
• A workaround for the issue, if a workaround is available

Issue 1

Symptom

If a client can access only read-only domain controllers, Windows Management Instrumentation (WMI) filters that are configured for Group Policy are not applied. Additionally, the Gpsvc.log file contains the following information:

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available.

Influence

The Group Policy object to which the WMI filters are linked may not be applied.

Workaround

No workaround is available for this issue.

Issue 2

Symptom

Internet Protocol security (IPsec) policies cannot be applied, and Win32 error code 8219 (ERROR_POLICY_OBJECT_NOT_FOUND) is returned when only Windows Server 2008 read-only domain controllers are available.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

Computers that are running Windows 2000, Windows XP, or Windows Server 2003 do not receive IPsec policies that are applied by a read-only domain controller.

Workaround

No workaround is available for this issue.

Issue 3

Symptom

Windows Server 2003 member computers and Windows XP member computers do not synchronize Win32 time with Windows Server 2008 read-only domain controllers.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario in which a writable domain controller cannot be contacted.

Note A perimeter network is also known as "DMZ," "demilitarized zone," and "screened subnet."

Influence

If the time of services is severely asynchronous, you may receive error messages when you try to access resources on the network.

Workaround

To work around this issue, configure the client computers to synchronize time from another domain controller that is available on the network.

Issue 4

Symptom

Computers in a perimeter network cannot join the domain.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario.

Influence

Computers cannot join the domain even though the computer account and the password are pre-populated on the read-only domain controller.

Workaround

To work around this issue, create firewall rules to enable a writable domain controller to be contacted.

Or, bridge the perimeter network and intranet networks. Do this only when your organization's policies allow for this operation.

Issue 5

Symptom

In a site that has only read-only domain controllers available, users try to change their passwords on computers that are running Windows 2000, Windows XP, or Windows Server 2003. When the users do this, the password change operation fails.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a perimeter network scenario.

Influence

Users cannot change their passwords.

Workaround

To work around this issue, create firewall rules to enable a writable domain controller to be contacted. Or, have the users change passwords by using a computer that is running Windows Vista or Windows Server 2008.

Issue 6

Symptom

Windows Server 2008 read-only domain controllers cannot retrieve or create the public key certificate by using the LsaRetrievePrivateData function or the LsaStorePrivateData function.

The call to the LsaRetrievePrivateData function finishes. However, a NULL value is returned for the private data.

The call to the LsaStorePrivateData function fails, and error code 0xc0000034 is returned.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario.

Influence

The Data Protection API (DPAPI) on clients that can access only read-only domain controllers cannot decrypt master keys unless these clients previously contacted a writable domain controller and retrieved a public key certificate. Even though a writable domain controller is available, the DPAPI still cannot decrypt master keys if the nearest domain controller is a read-only domain controller.

Workaround

When the DPAPI tries to decrypt master keys, make sure that the client has access to only a writable domain controller.

Note Typically, the DPAPI tries to decrypt master keys during password changes.

Issue 7

Symptom

When you try to publish a printer, the published printer may not work correctly.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

If a read-only domain controller receives a request to publish a printer, the read-only domain controller forwards the request to a writable domain controller. The spooler tries to read from the read-only domain controller immediately after the write action is implemented. However, the spooler does this before the printer publish information is replicated to the read-only domain controller. Therefore, the publish operation fails.

Workaround

No workaround is available for this issue.

Issue 8

Symptom

In a site that has only read-only domain controllers available, you use the Find Printer dialog box on a client computer that is running Windows 2000, Windows XP, or Windows Server 2003. When you do this, the Find Printer dialog box stops responding.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

Users cannot find printers that are published in Active Directory Domain Services.

Workaround

No workaround is available for this issue.

Issue 9

Symptom

Active Directory Service Interfaces (ADSI) API functions in Windows Server 2003 and in Windows XP always send requests to a remote writable domain controller instead of to a local read-only domain controller.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

This issue causes unnecessary network traffic and access latency.

Workaround

Make sure that all clients have connectivity to a writable domain controller when these clients call ADSI API functions. Do this even if the function calls make only read operations.

Issue 10

Symptom

Domain controllers that are running Windows Server 2003 perform automatic site coverage for sites that have read-only domain controllers.

Scenario and affected clients

This issue affects domain controllers that provide automatic site coverage for other branch office sites. Typically, this issue occurs in a branch office scenario.

Note This issue is unlike other issue that is listed in the article. For other issues, if you do not implement a suggested workaround, you apply a hotfix to clients that interact with an RODC. For this issue, if you do not implement a suggested workaround, you apply the hotfix to Windows Server 2003 domain controllers that perform automatic site coverage for sites that have an RODC. After you apply the hotfix, Windows Server 2003 domain controllers are able to detect RODC's in sites that would otherwise have been treated as empty. Additionally, the hotfix prevents Windows Server 2003 domain controllers publishing SRV records in the DNS of these sites, if this is required by automatic site coverage.

Influence

A domain controller that is running Windows Server 2003 may register its DNS SRV resource records for a site that contains a read-only domain controller. Therefore, the clients may not authenticate as expected with the local read-only domain controller. However, they may use DC's in other sites instead. 

Workaround

To work around this issue, use one of the following methods:

• Make sure that only domain controllers that are running Windows Server 2008 are present in the site that is closest to the read-only domain controller site.
• Disable automatic site coverage on domain controllers that are running Windows Server 2003. Be aware that this affects the publication of SRV records for all sites that the Windows Server 2003 domain controller treats as empty. For more information about automatic site coverage, visit the following Microsoft web site:
  
  http://technet.microsoft.com/en-us/library/cc732322(WS.10).aspx

Issue 11

Symptom

Domain controllers that are running Windows Server 2003 fail performing automatic site coverage, also for sites they should cover. The Netlogon.log contains the following information:

Scenario and affected clients

This issue affects clients in sites that have no local domain controller available.

Influence

The Dc Locator on the client may not be able to find the closest site. This may slow down the logon process and GPO application.

Workaround

Disable AutoSiteCoverage and cover DC-less sites manually.
 

Update information

Note

• The hotfix that is available in this Microsoft Knowledge Base article does not apply to Windows 2000 Server or to Windows 2000 Professional.
• Windows Vista SP1 does not need any hotfixes. Therefore, only Vista RTM is affected.

For more information about known issues for deploying RODCs, visit the following Web site:
http://technet.microsoft.com/it-it/library/cc725669(WS.10).aspx
The following files are available for download from the Microsoft Download Center:

Update for Windows Server 2003
Download the Update for Windows Server 2003 package now.

Update for Windows Server 2003 for Itanium-based systems
Download the Update for Windows Server 2003 for Itanium-based Systems package now.

Update for Windows Server 2003 x64 Edition
Download the Update for Windows Server 2003 x64 Edition package now.

Update for Windows XP x64 Edition
Download the Update for Windows XP x64 Edition package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Windows XP update information

Prerequisites

To apply this hotfix, you must have Windows XP Service Pack 2 or Windows XP Service Pack 3 installed.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows XP with Service Pack 2, x86-based versions

Windows XP with Service Pack 3, x86-based versions