Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000160

Read-Only Domain Controller (RODC) in Inconsistent State

High
Active Directory
Defense Evasion Persistence Privilege Escalation
v11

Signature Identity

CTD-000160
Threat ID
11
Version
IOE
Indicator Type

Threat Description

Read-Only Domain Controllers (RODCs) in an inconsistent state pose significant risks to the integrity and security of an Active Directory environment. RODCs are intended to provide a read-only replica of the Active Directory database, often in less secure locations. Inconsistent states due to replication failures, partial updates, or misconfigurations, can lead to outdated or incorrect data being served to clients, undermining authentication, authorization, and policy application. Additionally, threat actors may exploit this inconsistency to escalate privileges, bypass security controls, or compromise sensitive credentials cached on the RODC.

MITRE ATT&CK: Attack Tactics

Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

D3-OSM (Operating System Monitoring)

Remediation

  1. Use the repadmin tool to identify the current replication status of the Read-Only Domain Controller (RODC): repadmin /replsummary.
  2. Identify replication failures between the RODC and its writable replication partners.
  3. Check the Replication topology in Active Directory Sites and Services.
  4. Force synchronization to resolve inconsistencies: repadmin /syncall /AdeP.
  5. Ensure proper site and subnet configurations for the RODC.
  6. Audit and clear any cached credentials stored on the RODC to minimize exploitation risks: repadmin /rodcpwdrepl
  7. Limit which accounts are allowed to cache credentials using Password Replication Policy (PRP).
  8. Inspect Event Viewer logs on the RODC for replication errors, authentication issues, or unauthorized access attempts.
  9. Restore the consistency. For more details, see Troubleshoot common Active Directory replication errors.
  10. If replication or consistency issues persist, consider demoting and re-promoting the RODC:
    1. Backup any local configurations or changes before demotion.
    2. Use the Active Directory Domain Services Configuration Wizard for reinstallation.

For additional information, see Troubleshoot common Active Directory replication errors.

Frequently Asked Questions

What does Read-Only Domain Controller (RODC) in Inconsistent State mean?

A Read-Only Domain Controller (RODC) is a replica of the Active Directory database that provides read-only access. An inconsistent state occurs when the RODC's data is not synchronized with its writable replication partner, leading to outdated or incorrect data being served.

An inconsistent RODC state allows attackers to exploit authentication and authorization vulnerabilities by using outdated or incorrect credentials, group policies, or permissions. This can lead to unauthorized access and data breaches.

Attackers can exploit an inconsistent RODC state by using outdated or incorrect credentials, group policies, or permissions to gain unauthorized access. This occurs when the RODC's data is not synchronized with its writable replication partner, allowing attackers to bypass authentication and authorization controls.

Cayosoft Guardian continuously monitors the replication status of RODCs across the Active Directory environment and flags inconsistencies as security issues, alerting administrators to take corrective action.

Cayosoft Guardian provides visibility into replication status and alerts administrators to take corrective action, such as using the repadmin tool to identify replication failures and force synchronization. This ensures that RODCs are properly synchronized with their writable replication partners, minimizing the risk of inconsistent data being served.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Forest-wide Infrastructure Privileged Access Management
Attack Tactics
Defense Evasion Persistence Privilege Escalation
Defend Tactics
D3-OSM (Operating System Monitoring)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical