Recently, I have been working in an Windows Server 2008 R2 AD environment that has a number of RODCs in branch offices. The environment uses DFSR (i.e. not FRS) for SYSVOL replication an I wondered whether I could simply remove the connection objects named “RODC Connection (FRS)”. To me, the use of “FRS” in the name indicated that it was a probably a legacy object. Rather than going ahead with the removal, I thought I would first check on-line and with some fellow MVPs as well as Microsoft employees. Here’s what I found….
“The FRS connection objects are not required by DFS Replication” in the RODC Frequently Asked Questions article on Technet (note: this has since been reworded).
I also found this statement in the Directory Services Team Blog…
“Despite the mention only of FRS in this article, the 0x40 value is required for both DFSR and FRS”
The two statements are contradictory and it was only after helpful clarification from Microsoft’s Kurt Hudson that it transpires the connection object is required for SYSVOL replication using either method (i.e. FRS or DFSR). In other words if you are using DRSR for SYSVOL don’t delete these connection objects or you will need to manually recreate them (being sure to set the 0x40 bit in the options attribute as described in the DS team blog article).
I fired up an RODC on Windows Server 2010 Release Candidate yesterday and was pleased to see the connection object has been renamed to avoid confusion.
Windows Server 2008 R2
Windows Server 2012 Release Candidate
Well done Kurt! It’s great to see this sort of thing getting resolved.