See this askDS post for more details on running adprep

2\ Deploying a RODC:

adprep /rodcprep:

Minimum domain functional level: 2003.

A SMB storage device may be unable to use weak cryptography algorithms to establish a security channel to a Windows Server 2008-based domain controller.

Here is an example if your EMC Celerra target version is lower than 5.6:

As of version 5.6.42.5, Celerra Network Server supports Microsoft’s new SMB 2 protocol.

2\ Applications using Data Encryption Standard (DES) encryption for Kerberos authentication to a Windows 2008R2 domain controller will fail to authenticate.

Because this old cryptography algorithm is disabled by default.

Have a look a this example describing an SSO problem with SAP and a Windows 2008R2 DC.

As a bonus: The trust relationship breaks when the 2008R2 PDCe is renewing the trust password with a NT4.0 DC, a few days later. See TDO passwords chapter of this article.

2\ Deploying a RODC:

It will not advertise as a time source untill the PDCe is migrated to Windows server 2008, have a look at this article for information and a possible workaround.

2\ Another important point about FAS from the same article:

A rogue RODC can replicate RODC FAS data from a domain controller that runs Windows Server 2003 by making a replication request.

Do not configure a Windows 2003 DC as a replication partner of a Windows 2008 DC. Use dssite.msc and/or firewall rules to make sure it doesn’t happen.