Your network contains an Active Directory domain named contoso.com. The domain
contains a read-only domain controller (RODC) named R0DC1.
You create a global group named RODC_Admins.
You need to provide the members of RODC_Admins with the ability to manage the
hardware and the software on R0DC1. The solution must not provide RODC_Admins with
the ability to manage Active Directory objects.
What should you do?