Redundant DCs: Is it OK, to install the "Active Directory compatible Domain Controller" on a UCS Backup Node, that is supposed to be read-only?

[talleyrand]

Already asked this question a few weeks ago and did not get a reply…

after reading this:
https://docs.software-univention.de/ext-windows/5.0/en/index.html

I wrote this:

UCS and Read only donain controllers RODC

I’m looking at RODC. now according to the manual you do this: ucr set samba4/role=RODC univention-install univention-samba4 univention-run-join-scripts what is the difference between running : ucr set samba4/role=RODC to set the mode of READ ONLY then running “Active Directory-compatible Domain Controller” from the web front end? Secondly if we run the command line options, nothing is shown as being installed in the web front end (really there should be some icon or something) final…

also i have noticed that the system check tools seem to be failing on a RO system even without adding in the DC software.

on your R/O domain controller did you set the R/O flags as per the Univention Admin manual BEFORE setting it up?

I did , but I ALSO found the same problem you saw on a test system, that installing the
“Active Directory compatible Domain Controller”

ALSO started to make writes to the supposedly only R/O setup, so i did nto implement it in production.