To ensure users in the second office can authenticate locally and manage password changes during a WAN outage, your Active Directory (AD) design must focus on Site resilience and Writeable Directory services.
To add a second office to an existing Active Directory Domain Services (AD DS) forest, enabling local authentication, password changes during a Wide Area Network (WAN) outage, and using an RODC with an SMTP site link, follow this plan:
1. Pre-deployment Configuration (Active Directory Sites and Services)
*-> Create a New Site: In AD Sites and Services, create a new site for the second office (e.g.,
"BranchOffice2").
*-> Create Subnet: Create a new subnet object corresponding to the IP range of the second office and associate it with the "BranchOffice2" site.
Configure Site Link: Create a new site link between the main office and the second office. While high-speed links usually use IP, if using SMTP for low-bandwidth scenarios (as mentioned in the prompt), create an SMTP site link under the "Inter-Site Transports" folder. Note that SMTP does not support domain partition replication.
Pre-create RODC Account: To ensure security, pre-create the RODC computer account in AD and designate a local administrator in the second office to perform the installation.
*-> 2. RODC Installation
Incorrect:
[Not A]
There are two significant issues with the "SMTP site link" and "RODC" components that will prevent the setup from meeting the requirements:
The Problem with SMTP Site Links: SMTP site links are deprecated and only support asynchronous replication for the Schema, Configuration, and Global Catalog partitions. They do not support the replication of the Domain partition (user data/passwords). For a high-speed WAN link, an IP site link (RPC over IP) is the standard and necessary choice.
The Problem with RODCs: By design, a Read-Only Domain Controller (RODC) cannot process password changes directly. If the WAN link is down and a user attempts to change their password, the RODC cannot "write" that change. A writable Domain Controller is required in the second office to support password changes during a WAN outage.
[Not D]
Active Directory Lightweight Directory Services (AD LDS) primarily by binding to the service using LDAP with a username and password. AD LDS supports authentication for specific applications, often using local AD LDS user accounts or proxy objects that link to external AD DS users, without needing a full Active Directory domain.
Reference:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/creating-a-site-link-design