This is a Read-only Domain Controller (RODC). An RODC stores users and computers passwords according to the policy below. ...

This is a Read-only Domain Controller (RODC).  An RODC stores users and computers passwords according to the policy below.  Only passwords for accounts that are in the Allow groups and not in the Deny groups can be replicated to the RODC.