Assign an OU to a certain RODC

domain-controllerorganizational-unitreplicationrodc

I have a RWDC(A) and two RODC(B and C).i create an OU for each branch in RWDC however the OU and its content will be replicated to all DCs within the domain.

So I want to know can we assign an OU to a certain RODC?

Best Answer

The mechanism for controlling replication of passwords to a Read-Only Domain Controller (RoDC) is through Password Replication Policy (PRP). Passwords are the only part of the Domain partition of the Active Directory (AD) database that is selectively replicated to RoDC's. All the rest of the objects and attributes will be replicated.

PRP is based on security principals (Groups, Users, etc), not OUs (which are not security principals and do not have Security Identifiers).

It's a little unclear what you're asking, but if you're trying to say that you need to control the scope of replication for all objects in these OUs then, bluntly, either a separate AD Forest or Domain for each site is what you need. If you're doing this for security isolation concerns then separate Forests are really the only way to go.