AD DS domain controllers:
AD DS domain controller is a server role installed.
Domain Controller:
1, carrying a copy of the directory store AD DS
2, provides authentication and authorization services, protocols, using the Kerberos , refer to the article https://www.cnblogs.com/zpchcbd/p/11707302.html
3, copy the update to the domain and other domain controllers in the forest
4 allows managing user accounts and network resources on the server
Windows Server 2008 AD DS support RODC (Read-Only Domain Controller)
RODC (Read-Only Domain Controller) : Read-only AD DS database, for safety consideration, under can imagine, if you get the domain account of the current pipe under the domain landing up, such an operation is very dangerous tampering
DNS and AD DS Overview: