Those two groups should be also checked in order to see if a DC can do the exop repl_object_with_secrets (for the moment we rely only on the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup attribute
That might not be so true, must recheck
No 4.1 blocker => 4.2
Any news on this one?
These groups are currently added to the multi-valued attributes e.g. msDS-RevealOnDemandGroup upon RODC join. Closing this bug.