A read-only domain controller caches only the passwords (and, depending on the Password Replication Policy, credentials) of a limited set of accounts, but by default it still holds a full read-only copy of every other attribute ' s value for objects in its domain partition, including custom or sensitive attributes such as Employee-Number, unless that attribute has been specifically excluded. The mechanism for excluding a specific attribute from ever being replicated to any RODC is the RODC Filtered Attribute Set (FAS), which is configured by setting a bit in the searchFlags property of that attribute ' s attributeSchema object - and the schema, including every attributeSchema object, lives in the forest-wide schema partition, not in the domain, configuration, or global catalog partition. Marking Employee-Number as confidential/filtered in the schema partition causes it to be excluded from replication to any RODC in the forest going forward, meaning RODC1 would never hold that attribute ' s value at all, so even a full compromise of RODC1 ' s computer account (and therefore its cached directory data) could not expose it. Modifying the domain partition would not affect what an RODC caches, since the RODC FAS is a schema-level, forest-wide setting, not a domain-level one; the configuration partition manages forest-wide configuration data unrelated to attribute filtering; and there is no separate, independently modifiable global catalog partition - global catalog status is a server property, not a directory partition. The schema partition is therefore the one to modify.

Both Kerberos V5-based authentication methods, whether configured as Computer (Kerberos V5) or the less common User (Kerberos V5) variant, fundamentally require that both endpoints of the connection be joined to, and trusted by, the same Active Directory domain, since Kerberos authentication depends entirely on that domain trust relationship to issue and validate tickets. Because the two workgroup servers in this scenario are not joined to the domain at all, neither Kerberos-based method can successfully authenticate a connection security rule between them and the five domain member servers, and NTLMv2, while it can work across a domain trust in some configurations, still generally depends on a domain or trusted account context that a plain workgroup server does not participate in for this kind of IPsec connection security scenario. Computer certificate authentication, by contrast, does not depend on Active Directory domain membership at all; it only requires that both computers, regardless of whether they are domain-joined or standalone workgroup members, trust a common certification authority and each hold an appropriate certificate issued by that authority. This makes computer certificate authentication the correct and supported method for securing an IPsec connection security rule between domain-joined member servers and workgroup servers, which is exactly the mixed-membership scenario described.

Explanation:
Server2 can ping Server1 successfully: Yes. Server2 can connect to a file share on Server1: Yes. Server3 can connect to a file share on Server1: No.
Server1 ' s connection security rule, Rule1, requires authentication for both inbound and outbound connections on the Domain profile using the Computer (Kerberos V5) method, and Server1 ' s inbound firewall rules for File and Printer Sharing, including the ICMPv4 and ICMPv6 Echo Request rules and the SMB-In rule, are all enabled and set to Allow. Server2 has an identical connection security rule configured, also using Computer (Kerberos V5) authentication on the Domain profile, so Server1 and Server2 can successfully negotiate the mandatory IPsec security association that Rule1 requires; because the underlying firewall rules for ICMP and SMB traffic already allow the traffic through, Server2 can both successfully ping Server1 and connect to a file share on Server1 once that IPsec authentication succeeds. Server3, however, has no connection security rule configured in this scenario that matches Server1 ' s requirement, so it cannot complete the mandatory IPsec authentication that Rule1 demands for all inbound and outbound traffic on Server1; even though the SMB-In firewall rule would otherwise permit the traffic, the connection security requirement blocks Server3 from establishing the necessary secured session, so Server3 cannot connect to a file share on Server1.

Because the ten servers are in a workgroup rather than joined to an Active Directory domain, Kerberos V5 is not usable as an authentication method for a connection security rule, since Kerberos V5 depends on a domain controller acting as the Key Distribution Center, which workgroup servers do not have access to. Of the remaining options actually usable in a workgroup, a computer certificate issued from a trusted certification authority provides much stronger, mutually verifiable authentication than either a shared pre-shared key or NTLMv2. Windows Defender Firewall with Advanced Security guidance explicitly identifies pre-shared keys and NTLM-based authentication as weaker fallback methods appropriate only when certificates or Kerberos are unavailable, precisely because a pre-shared key is a single shared secret with no per-computer identity verification and NTLMv2 is an older, less robust protocol vulnerable to several known attack classes.
Certificate-based authentication, by contrast, lets each server present its own distinct, verifiable identity, making it the most secure choice available for encrypting workgroup server-to-server traffic. Therefore, computer certificate authentication is the correct choice.

The netdom.exe command-line tool includes a query fsmo operation that enumerates all five operations master (FSMO) roles in the forest and domain and reports the fully qualified domain name of the server currently holding each one: the Schema Master and Domain Naming Master (forest-wide roles), and the RID Master, PDC Emulator, and Infrastructure Master (domain-wide roles). Because the output explicitly lists the current PDC Emulator holder alongside the other four roles, running netdom query fsmo does identify which server holds that role, and it does so without requiring any graphical console, making it convenient for use on Server Core installations, through remote PowerShell/CMD sessions, or in automated scripts. This is functionally equivalent to checking the PDC tab of the Operations Masters dialog in Active Directory Users and Computers, or running Get-ADDomain / netdom ' s counterpart Ntdsutil commands, all of which are documented, supported ways to confirm FSMO placement. Administrators commonly use this command during routine health checks, before planning a role transfer or seizure, or when troubleshooting time synchronization and password issues, both of which are anchored to the PDC Emulator. Since the command reliably and correctly surfaces the PDC Emulator ' s host name as part of its normal output, this solution does meet the stated goal.