Allowed RODC Password Replication Group

Certificate Service DCOM Access

Denied RODC Password Replication Group

Enterprise Read-Only Domain Controllers

Incoming Forest Trust Builders

Network Configuration Operators

Pre-Windows 2000 Compatible Access

Read-Only Domain Controllers

Terminal Server License Servers

Windows Authorization Access Group