DRAG DROP
You manage an Active Directory Domain Services forest that contains a root domain named contoso.com
and a child domain named branch.contoso.com. You have three servers named SRV01, SRV02, and
SRV03. All servers run Windows Server 2012 R2. SRV01 and SRV02 are domain controllers for the domain
contoso.com. SRV03 is the domain controller for branch.contoso.com. User accounts and resources exist
in both domains. All resources in branch.contoso.com are physically located in a remote branch office.
The remote branch office must be configured as Read-Only Domain Controller (RODC). The solution must
minimize the impact on users and the number of servers deployed in the branch office.
You need to configure the environment.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the
list of actions to the answer area and arrange them in the correct order.
Answer: 
Explanation:
Box 1: We export all resources from the branch office, and import them into the main domain.
Ldidfe creates, modifies, and deletes directory objects. You can also use ldifde to extend the schema,
export Active Directory user and group information to other applications or services, and populate Active
Directory Domain Services (AD DS) with data from other directory services.
Box 2: We decommission the domain controller SRV03
Box 3: And make it a RODC instead.
Incorrect:
We should not use an additional server SRV04.
Ldifde
https://technet.microsoft.com/en-us/library/cc731033.aspx
ADMT instead of ldifde
https://support.microsoft.com/en-us/kb/555634
“6. LDIFDE doesn’t support exporting Passwords.”
The use of ldifde implies more troubles (password change) for users.
1
0
I was totally on-board with you on this one. Turns out LDIFDE can export passwords. Looks like the given answer is right.
https://technet.microsoft.com/en-us/library/cc816781(v=ws.10).aspx
(About 3/4 of the way down the page)
0
1
Bit of a strange question. The migration from branch.contoso.com to contoso.com and the 3 steps above (with sdquirra’s correction) do meet the requirements of an rodc and minimal number of servers, but it maximises, not minimises, the impact on users.
0
0
Yeah, this is an odd-ball question. I would have stood up a whole new RODC in the branch, then demoted/disjoined the existing DC. No downtime at all and it’s minimizing the server count.
0
0
why is nobody talking about ADMT?
0
0
ADMT allows for SID history hence doesn’t lead to password change for all users
0
0
ADMT is correct:
https://technet.microsoft.com/en-us/library/cc974342(WS.10).aspx
0
0
Your link talks about inter-forest restructuring. That’s not the case in this question.
0
0
Right answer or not I would:
1) Install SRV04
2) Promote SRV04 to an RODC
3) Uninstall AD on SRV03.
There is SO much less effort involved with this method.
0
1