/PasswordReplicationDenied:{"security_principal" | None} Specifies the names of users, groups, and computer accounts whose ...

/PasswordReplicationDenied:{"security_principal" | None}
Specifies the names of users, groups, and computer accounts whose passwords are not to be replicated to this RODC. Specify "None" if you do not want to deny the replication of credentials of any users or computers. By default, Administrators, Server Operators, Backup Operators, Account Operators, and the Denied RODC Password Replication Group are denied. By default, the Denied RODC Password Replication Group includes Cert Publishers, Domain Admins, Enterprise Admins, Enterprise Domain Controllers, Enterprise Read-Only Domain Controllers, Group Policy Creator Owners, the krbtgt account, and Schema Admins.