protocol domain-auth replication replicate-user

domain <domain>	Specifies the Active Directory replication domain. The domain name must be in Active Directory domain name format. The SteelHead replicates accounts from this domain.
user-domain <user-domain>	Specifies the domain that the user belongs to, if different from the Active Directory domain name. Riverbed recommends that you configure the user domain as close to the root as possible.
user <name>	Specifies the replication username. The maximum length is 20 characters. The username cannot contain any of the following characters: / \ [ ] : ; \| = , + * ? < > @ " Note: The system translates the username into uppercase to match the registered server realm information.
password <password>	Specifies the user account password.
rodc <true \| false>	Functions as read-only domain controller (RODC) settings for this domain. Specify true to enable the RODC function. Specify false to disable the RODC function.
dcname <dcname>	Specifies the Windows domain controller for this domain.

Kerberos end-to-end authentication in RiOS 7.0 relies on Active Directory replication to obtain machine credentials for any servers that require secure protocol optimization. The RiOS replication mechanism requires a domain user with AD replication privileges and involves the same AD protocols used by Windows domain controllers.