Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients and for Windows Vista

This article describes the Windows Server 2008 read-only domain controller (RODC) compatibility pack for Windows Server 2003 clients and for Windows XP clients. This update addresses compatibility issues that occur with down-level clients that do not support Windows Server 2008 RODC features. The information in this article also applies to Windows Server 2008 R2 RODC. 

You do not necessarily have to apply this update before you can deploy a read-only domain controller. Sometimes, compatibility issues do not affect your deployment. Or, you may be able to use a workaround instead of applying the update.

The following sections describe the following items:

• The symptom that is associated with each compatibility issue
• The RODC deployment scenario in which the issue occurs and the clients that are affected by the issue
• The issue's influence
• A workaround for the issue, if a workaround is available

Issue 1

Symptom

If a client can access only read-only domain controllers, Windows Management Instrumentation (WMI) filters that are configured for Group Policy are not applied. Additionally, the Gpsvc.log file contains the following information:

GPSVC(410.8ec) 15:17:45:808 FilterCheck: Found WMI Filter id of: filter ID
GPSVC(410.8ec) 15:18:21:838 FilterCheck: Filter doesn't exist. Evaluating to false
GPSVC(410.8ec) 15:18:21:838 ProcessGPO: CheckFilterAcess failed for <cn=GUID,cn=policies,cn=system,DC=name,DC=name,DC=name,DC=com>. Filter not found
GPSVC(410.8ec) 15:18:21:838 CGPAdminEventInitFailure::Initialize(): FormatMessage failed to look up error code (0x80041002) due to error 317. Can not log error description.
GPSVC(410.8ec) 15:18:21:838 ProcessGPO: The GPO does not pass the filter check and so will not be applied.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available.

Influence

The Group Policy object to which the WMI filters are linked may not be applied.

Workaround

No workaround is available for this issue.

Issue 2

Symptom

Internet Protocol security (IPsec) policies cannot be applied, and Win32 error code 8219 (ERROR_POLICY_OBJECT_NOT_FOUND) is returned when only Windows Server 2008 read-only domain controllers are available.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

Computers that are running Windows 2000, Windows XP, or Windows Server 2003 do not receive IPsec policies that are applied by a read-only domain controller.

Workaround

No workaround is available for this issue.

Issue 3

Symptom

Windows Server 2003 member computers and Windows XP member computers do not synchronize Win32 time with Windows Server 2008 read-only domain controllers.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario in which a writable domain controller cannot be contacted.

Note A perimeter network is also known as "DMZ," "demilitarized zone," and "screened subnet."

Influence

If the time of services is severely asynchronous, you may receive error messages when you try to access resources on the network.

Workaround

To work around this issue, configure the client computers to synchronize time from another domain controller that is available on the network.

Issue 4

Symptom

Computers in a perimeter network cannot join the domain.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario.

Influence

Computers cannot join the domain even though the computer account and the password are pre-populated on the read-only domain controller.

Workaround

To work around this issue, create firewall rules to enable a writable domain controller to be contacted.

Or, bridge the perimeter network and intranet networks. Do this only when your organization's policies allow for this operation.

Issue 5

Symptom

In a site that has only read-only domain controllers available, users try to change their passwords on computers that are running Windows 2000, Windows XP, or Windows Server 2003. When the users do this, the password change operation fails.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a perimeter network scenario.

Influence

Users cannot change their passwords.

Workaround

To work around this issue, create firewall rules to enable a writable domain controller to be contacted. Or, have the users change passwords by using a computer that is running Windows Vista or Windows Server 2008.

Issue 6

Symptom

Windows Server 2008 read-only domain controllers cannot retrieve or create the public key certificate by using the LsaRetrievePrivateData function or the LsaStorePrivateData function.

The call to the LsaRetrievePrivateData function finishes. However, a NULL value is returned for the private data.

The call to the LsaStorePrivateData function fails, and error code 0xc0000034 is returned.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario or in a perimeter network scenario.

Influence

The Data Protection API (DPAPI) on clients that can access only read-only domain controllers cannot decrypt master keys unless these clients previously contacted a writable domain controller and retrieved a public key certificate. Even though a writable domain controller is available, the DPAPI still cannot decrypt master keys if the nearest domain controller is a read-only domain controller.

Workaround

When the DPAPI tries to decrypt master keys, make sure that the client has access to only a writable domain controller.

Note Typically, the DPAPI tries to decrypt master keys during password changes.

Issue 7

Symptom

When you try to publish a printer, the published printer may not work correctly.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

If a read-only domain controller receives a request to publish a printer, the read-only domain controller forwards the request to a writable domain controller. The spooler tries to read from the read-only domain controller immediately after the write action is implemented. However, the spooler does this before the printer publish information is replicated to the read-only domain controller. Therefore, the publish operation fails.

Workaround

No workaround is available for this issue.

Issue 8

Symptom

In a site that has only read-only domain controllers available, you use the Find Printer dialog box on a client computer that is running Windows 2000, Windows XP, or Windows Server 2003. When you do this, the Find Printer dialog box stops responding.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

Users cannot find printers that are published in Active Directory Domain Services.

Workaround

No workaround is available for this issue.

Issue 9

Symptom

Active Directory Service Interfaces (ADSI) API functions in Windows Server 2003 and in Windows XP always send requests to a remote writable domain controller instead of to a local read-only domain controller.

Scenario and affected clients

This issue affects clients in a site that has only read-only domain controllers available. Typically, this issue occurs in a branch office scenario.

Influence

This issue causes unnecessary network traffic and access latency.

Workaround

Make sure that all clients have connectivity to a writable domain controller when these clients call ADSI API functions. Do this even if the function calls make only read operations.

Issue 10

Symptom

Domain controllers that are running Windows Server 2003 perform automatic site coverage for sites that have read-only domain controllers.

Scenario and affected clients

This issue affects domain controllers that provide automatic site coverage for other branch office sites. Typically, this issue occurs in a branch office scenario.

Note This issue is unlike other issue that is listed in the article. For other issues, if you do not implement a suggested workaround, you apply a hotfix to clients that interact with an RODC. For this issue, if you do not implement a suggested workaround, you apply the hotfix to Windows Server 2003 domain controllers that perform automatic site coverage for sites that have an RODC. After you apply the hotfix, Windows Server 2003 domain controllers are able to detect RODC's in sites that would otherwise have been treated as empty. Additionally, the hotfix prevents Windows Server 2003 domain controllers publishing SRV records in the DNS of these sites, if this is required by automatic site coverage.

Influence

A domain controller that is running Windows Server 2003 may register its DNS SRV resource records for a site that contains a read-only domain controller. Therefore, the clients may not authenticate as expected with the local read-only domain controller. However, they may use DC's in other sites instead. 

Workaround

To work around this issue, use one of the following methods:

• Make sure that only domain controllers that are running Windows Server 2008 are present in the site that is closest to the read-only domain controller site.
• Disable automatic site coverage on domain controllers that are running Windows Server 2003. Be aware that this affects the publication of SRV records for all sites that the Windows Server 2003 domain controller treats as empty. For more information about automatic site coverage, visit the following Microsoft web site:
  
  http://technet.microsoft.com/en-us/library/cc732322(WS.10).aspx
  (http://technet.microsoft.com/en-us/library/cc732322(WS.10).aspx)

Issue 11

Symptom

Domain controllers that are running Windows Server 2003 fail performing automatic site coverage, also for sites they should cover. The Netlogon.log contains the following information:

Scenario and affected clients

This issue affects clients in sites that have no local domain controller available.

Influence

The Dc Locator on the client may not be able to find the closest site. This may slow down the logon process and GPO application.

Workaround

Disable AutoSiteCoverage and cover DC-less sites manually.

Update information

Note

• The hotfix that is available in this Microsoft Knowledge Base article does not apply to Windows 2000 Server or to Windows 2000 Professional.
• Windows Vista SP1 does not need any hotfixes. Therefore, only Vista RTM is affected.

For more information about known issues for deploying RODCs, visit the following Web site:
http://technet.microsoft.com/it-it/library/cc725669(WS.10).aspx
The following files are available for download from the Microsoft Download Center:

Update for Windows Server 2003
Download the Update for Windows Server 2003 package now.

Update for Windows Server 2003 for Itanium-based systems
Download the Update for Windows Server 2003 for Itanium-based Systems package now.

Update for Windows Server 2003 x64 Edition
Download the Update for Windows Server 2003 x64 Edition package now.

Update for Windows XP
Download the Update for Windows XP package now.

Update for Windows XP x64 Edition
Download the Update for Windows XP x64 Edition package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Windows XP update information

Prerequisites

To apply this hotfix, you must have Windows XP Service Pack 2 or Windows XP Service Pack 3 installed.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows XP with Service Pack 2, x86-based versions

Windows XP with Service Pack 3, x86-based versions

Windows Server 2003 update information

Prerequisites

To apply this hotfix, you must have Windows Server 2003 Service Pack 1 or Windows Server 2003 Service Pack 2 installed.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003 with Service Pack 1, x86-based versions

Windows Server 2003 with Service Pack 2, x86-based versions

Windows Server 2003 with Service Pack 1, Itanium-based versions

Windows Server 2003 with Service Pack 2, Itanium-based versions

Windows Server 2003 with Service Pack 1, x64-based versions

Windows Server 2003 with Service Pack 2, x64-based versions

Windows Vista service pack information

To resolve this problem, you can install the latest Windows Vista service pack.

For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

Windows Vista update information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart Requirement

You must restart the computer after you apply this hotfix.

Hotfix Replacement Information

This hotfix does not replace a previously released hotfix.

File Information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, x64-based versions

About WMI filters

You can use a WMI filter to specify criteria that must be met before the linked Group Policy object is applied to a computer. The WMI filter can filter the computers to which you want to apply the Group Policy settings so that you do not have to subdivide your organizational unit.

How to enable logging in the Gpsvc.log file

To enable logging in the Gpsvc.log file, follow these steps.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
3. On the Edit menu, point to New, and then click Key.
4. Type Diagnostics, and then press ENTER.
5. Right-click the Diagnostics subkey, point to New, and then click DWORD Value.
6. Type GPSvcDebugLevel, and then press ENTER.
7. Right-click GPSvcDebugLevel, and then click Modify.
8. In the Value data box, type 0x30002, and then click OK.
9. Exit Registry Editor.
10. At a command prompt, type the following command, and then press ENTER:
    gpupdate /force
11. View the Gpsvc.log file in the following folder:
    %windir%\debug\usermode
    
    Note - if the usermode folder does not exist under %WINDIR%\debug\ the gpsvc.log file will not be created. If the usermode folder does not exist, create it under %windir%\debug.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: