Legal Information |
|
A Domain Tree is a group of domains that share a contiguous namespace as above. These domains are all connected together and users in any domain potentially have access to resources in any of the domains within the tree.
The lines between the domains represent automatic two way, transitive trusts. This means that when you add a domain to a tree there is no need to set up trust relationships between the domains. It also means, as is the case of the illustration above, that a user in admin.glasgow.comsurf.co.uk could potentially access resources in comsurf.co.uk even though there is not a direct trust.
Network design should attempt to minimise the number of domains because it will simplify things.
To create a tree, the installer creates the root domain first by promoting a domain controller in that domain. Then all other domains are promoted in such a way as to define the link between these domains, and the parent-child relationship.
A forest is a group of Domain Trees. Users within the forest potentially have access to resources in any of the domains within the forest.
A forest of trees shares a common schema, and has a non-contiguous name space. This arrangement is typical only for very large organisations, and is desirable because a certain degree of inter-operability is required, but most administrative function needs to be kept separate.
To facilitate the above, create the first tree (or at least the root domain of the first tree) and then create the root domain of the second tree, indicating that you are joining an existing forest.
Search Knowledge Base | Feedback |