administrator role separation

The ability to delegate local administrative permissions for a read-only domain controller (RODC) to any domain user without granting that user any user rights for the domain or other domain controllers.