A read-only domain controller (RODC) is a type of domain controller that can read files and network resources but cannot alter the domain or Active Directory. RODCs provide services like replication and backup without the ability to make changes. They are installed by promoting a computer to an RODC, which then houses read-only operations for Active Directory Domain Services. RODCs are useful in situations that require additional security as they cannot modify production domain controllers or Active Directory domains that contain a writable domain controller.