Add-ADDomainControllerPasswordReplicationPolicy - AD Cmdlet Reference

Add-ADDomainControllerPasswordReplicationPolicy

This cmdlet is there to manage the Password Replication Policy for RODC's.  A handy tool as without the AD management pack, you can only do this at the command line with repadmin!

Example usage

Add-ADDomainControllerPasswordReplicationPolicy -identity $RODC -AllowedList $group

Define the parameters

Both identity and AllowedList (also, DeniedList) take a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser or in the case below, Get-ADDomainController.

In a script
In this script, I get every RODC, and firestly build a list of group names from the first 6 characters of the RODC name.  I then get the allowed list from the RODC and check my built list against the PRP entries.  For any that are not already members, I add them

foreach ($RODC in $(Get-ADDomainController -filter { isreadonly -eq $true })) {
   [string]$sitecode = $($RODC.name).substring(0,6)
   $list = "$($sitecode)Servers","$($sitecode)Users","$($sitecode)computers"
   $allowedPolicy = $(Get-ADDomainControllerPasswordReplicationPolicy -id $rodc -allowed) | select "samaccountname"
   Foreach ($group in $list) {
      If ($($allowedPolicy | % {$_.samaccountname}) -notcontains $group){
         Add-ADDomainControllerPasswordReplicationPolicy -identity $RODC -AllowedList $group
      }
   }
}

Powershell without the Management pack

I have searched for this functionallity within .net to no avail.  The only way I have found to do this sort of thing without the AD management pack is to call repadmin from within powershell.

repadmin /prp add $RODC allow $group