Your company has a main office and a branch office. Your network consists of one Active Directory
domain. All domain controllers run Windows Server 2008 R2. You need to plan the installation of a
new server as a read-only domain controller (RODC) in the branch office. The plan must meet the
following requirements:
A branch office user must complete the RODC installation.
The branch office user must only be a member of only the Domain Users security group.
What should you do first?
A.
Create an installation media by using ntdsutil.
B.
Instruct the user to join the new server to the domain.
C.
Pre-create a read-only domain controller (RODC) account for the branch office server.
D.
Create an organizational unit (OU) for the branch office. Delegate full control of the OU to the
branch office user.
Explanation:
To install a new server as a read-only domain controller (RODC) in the branch office and to ensure
that the users of branch office must only be a member of the Domain Users security group, you need
to Pre-create a read-only domain controller (RODC) account for the branch office server. When you
pre-create the RODC account, you can delegate the installation and administration of the RODC to a
user or better a security group.
Active Directory Domain Services: RODC (Read-Only Domain Controller) / Administrator
Role Separation
http://trycatch.be/blogs/roggenk/archive/2007/08/01/active-directory-domain-services-rodc-readonly-domain-controller.aspx