Domains, Trees, Forests

Domains, Trees & Forests

• Every Domain is part of a Tree, is part of a Forest (even a single domain)
• Domains which share the parent domain name belong to the same tree
• Trust Relationships connect domains
• Forest Root (Root Domain) - First domain, cannot change
  • Enterprise admins control entire forest
  • Domain admins control their domain
• Trees later merged via forest trust will share resources but not schema
• Global catalogue is replicated across the whole forest

Trusts

• Trust Relationships can have a
  • Two-way transitive trust (follows through to sub-domains)
  • One-way directional trust
  • Shortcut trust (can be either of the above) (two or one way)
  • Forest trust - between two forests (unlike below) (two or one way) 
    
  • Realm trust - Unix/Linux Realm (Kerberos)
    

Setup via Active Directory Domains and Trusts

Configure DNS to ensure they can communicate (conditional forwarders)

KCC

• Knowledge consistency checker - all D.Cs have it
• Creates a circular ring of trust between D.Cs in close proximity (latency) within the same site (intrasite replication)
• Updates based on D.C. Availbility, checks every 15 minutes

Separation of sites frees up bandwidth.

KCC Creates new rings within each site and appoints one D.C. as a Bridge Head (every 180 minutes) (can be altered) (Inter-Site Replication)

Site Links

• Redundant site links are setup, each have a cost (default 100)
• Adjust cost based on primary and secondary links
• IP Addresses are set such that devices interact with their local D.C. (Subnets)
• Site link bridging can be setup based on a hierarcy (default all on)
• May wish to disable site link bridging where a site has multiple sub-sites

Configured and Managed via AD DS > Sites