---
title: Read-only replicas
description: Configure a PingDS replica as read-only to refuse updates from client applications, or reset it to the default read-write mode.
component: pingds
version: 8
page_id: pingds:config-guide:repl-read-only
canonical_url: https://docs.pingidentity.com/pingds/8.1/config-guide/repl-read-only.html
llms_txt: https://docs.pingidentity.com/pingds/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2024-12-12T14:58:04Z
keywords: ["Features", "LDAP", "Replication", "Setup & Configuration", "Troubleshooting"]
superseded_by: https://docs.pingidentity.com/pingds/8.1/config-guide/repl-read-only.html
section_ids:
  read_only: Read-only
  read_write: Read-write
---

# Read-only replicas

By default, all directory servers in a replication topology are read-write.

## Read-only

The following command causes the replica to accept only internal updates and refuse updates from client applications:

```console
$ dsconfig \
 set-global-configuration-prop \
 --set writability-mode:internal-only \
 --hostname replica.example.com \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Changing to `writability-mode:internal-only` prevents updates from external directory client applications. For example, it allows all internal updates, meaning the replica receives replication changes.To prevent replication from replaying any updates from a read-only replica, configure the replication servers to [trust *the other* replicas](repl-trusted.html) in the deployment.Don't trust the read-only replica, and replication servers ignore its changes. |

## Read-write

The following command resets `writability-mode` to the default setting:

```console
$ dsconfig \
 set-global-configuration-prop \
 --set writability-mode:enabled \
 --hostname replica.example.com \
 --port 4444 \
 --bindDN uid=admin \
 --bindPassword password \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --no-prompt
```