administrator role separation

系統管理員角色隔離 (The ability to delegate local administrative permissions for a read-only domain controller (RODC) to any domain user without granting that user any user rights for the domain or other domain controllers)