Skip to content

Forrests & domains

A forest is a collection of domains that share
- a common logical structure,
- directory schema (class and attribute definitions),
- directory configuration (site and replication information),
- and global catalog (forest-wide search capabilities).
Domains in the same forest are automatically linked with two-way, transitive trust relationships.

A domain is a partition in an Active Directory forest
Its main goal is to replicate data only to where it is needed
But it also has a number of other core functions related to administration (

organizational units
OUs can be used to form a hierarchy of containers within a domain.
OUs are used to group objects for administrative purposes such as the application of Group Policy or delegation of authority.
Control (over an OU and the objects within it) is determined by the access control lists (ACLs) on the OU and on the objects in the OU. To facilitate the management of large numbers of objects, AD DS supports the concept of delegation of authority. By means of delegation, owners can transfer full or limited administrative control over objects to other users or groups. Delegation is important because it helps to distribute the management of large numbers of objects across a number of people who are trusted to perform management tasks.

Single Forest, Single Domain versus Single Domain, Multiple OU design

AD design :
- Single Forest
- Single Domain with Multiple OUs
- Single Forest
- Root Domain and multiple Child Domains with Multiple OUs within each Child Domain.

transient trust relationship

My AD would be spread over different geograpical locations, Say Location A, B and C. With an MPLS dedicated backbone of a minimum of 1.5MBps available across each of the three locations, I have a maximum userbase of about 2000 users in Location A which has a 2MB link. Others are much less. Exchange would be integrated at a later stage and most of the data flying across would be VoIP and Emails.
five questions :

  1. What should be the defining factor for my Root Domain location? How do I take care of redundancy there?

  2. Microsoft recommends that with a slowest link of 1500KBps connecting two locations, and 10% of bandwidth dedicated for accomodating replication, I can have 100,000 users (Ref: Chap 2 of MSPRESS Deployment Kit Book: Designing the AD Logical Structure). I don’t have this many users at any location, so can I work with Single Forest Single Domain, Multiple OUs model?

  3. When does someone look at multiple domain model vis a vis multiple OU’s within a single domain?

  4. If I go for multiple OU’s within single domain, how would I design my Site topology where each OU would correspond to Location A , B and C.

  5. Any special design issue to take into consideration now if we plan to migrate to Windows 2008 later? (answer to this is optional).