Your network contains an Active Directory domain named contoso.com. The domain contains a
read-only domain controller (RODC) named RODC1.
You create a global group named RODC_Admins.
You need to provide the members of RODC_Admins with the ability to manage the hardware and
the software on RODC1.
The solution must not provide RODC_Admins with the ability to manage Active Directory objects.
What should you do?
A.
From a command prompt, run the dsadd computer command.
B.
From Active Directory Users and Computers, run the Delegation of Control Wizard.
C.
From Active Directory Users and Computers, configure the Member Of settings of the RODC1
account.
D.
From a command prompt, run the dsmgmt local roles command.
Explanation:
http://technet.microsoft.com/en-us/library/cc731885.aspx
http://technet.microsoft.com/en-us/library/cc732473.aspx
Manages Administrator Role Separation for a read-only domain controller (RODC). Administrator
role separation provides a nonadministrative user with the permissions to install and administer an
RODC, without granting that user permissions to do any other type of domain administration.