Your network contains an Active Directory domain named contoso.com. The domain contains a read-only
domain controller (RODC) named RODC1.
You create a global group named RODC_Admins.
You need to provide the members of RODC_Admins with the ability to manage the hardware and the software
on RODC1.
The solution must not provide RODC_Admins with the ability to manage Active Directory objects.
What should you do?

A.
From a command prompt, run the dsadd computer command.

B.
From Windows PowerShell, run the Set-ADAccountControl cmdlet.

C.
From Active Directory Sites and Services, run the Delegation of Control Wizard.

D.
From a command prompt, run the dsmgmt local roles command.

Explanation:
http://technet.microsoft.com/en-us/library/cc731885.aspx
http://technet.microsoft.com/en-us/library/cc732473.aspx
Manages Administrator Role Separation for a read-only domain controller (RODC). Administrator role
separation provides a nonadministrative user with the permissions to install and administer an RODC, without
granting that user permissions to do any other type of domain administration.