---
title: Read-only replicas
description: Configure a PingDS replica as read-only to refuse updates from client applications, or reset it to the default read-write mode.
component: pingds
version: 7.5
page_id: pingds:config-guide:repl-read-only
canonical_url: https://docs.pingidentity.com/pingds/8.1/config-guide/repl-read-only.html
llms_txt: https://docs.pingidentity.com/pingds/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-08-10T15:45:40Z
keywords: ["Features", "LDAP", "Replication", "Setup & Configuration", "Troubleshooting"]
superseded_by: https://docs.pingidentity.com/pingds/8.1/config-guide/repl-read-only.html
---

# Read-only replicas

By default, all directory servers in a replication topology are read-write.

The following command causes the replica to accept only replication updates, and to refuse updates from client applications:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --set writability-mode:internal-only \
 --hostname replica.example.com \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

The following command resets the replica to the default behavior:

```bash
$ dsconfig \
 set-global-configuration-prop \
 --set writability-mode:enabled \
 --hostname replica.example.com \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```