# Domains, Trees, Forests

#### Domains, Trees & Forests

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/es7image.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/es7image.png)

- Every **Domain** is part of a **Tree**, is part of a **Forest** (even a single domain)
- Domains which share the parent domain name belong to the same tree
- **Trust Relationships** connect domains
- **Forest Root (Root Domain)** - First domain, cannot change 
    - Enterprise admins control entire forest
    - Domain admins control their domain
- Trees later merged via forest trust will share resources but not schema
- Global catalogue is replicated across the whole forest

#### Trusts

- Trust Relationships can have a 
    - Two-way transitive trust (follows through to sub-domains)
    - One-way directional trust
    - Shortcut trust (can be either of the above) (two or one way)
    - Forest trust - between two forests (unlike below) (two or one way)
    - Realm trust - Unix/Linux Realm (Kerberos)

Setup via Active Directory Domains and Trusts

Configure DNS to ensure they can communicate (conditional forwarders)

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/SVSimage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/SVSimage.png)

#### KCC

- Knowledge consistency checker - all D.Cs have it
- Creates a circular ring of trust between D.Cs in close proximity (latency) within the same site (intrasite replication)
- Updates based on D.C. Availbility, checks every 15 minutes

Separation of sites frees up bandwidth.

KCC Creates new rings within each site and appoints one D.C. as a Bridge Head (every 180 minutes) (can be altered) (Inter-Site Replication)

#### Site Links

- Redundant site links are setup, each have a cost (default 100)
- Adjust cost based on primary and secondary links
- IP Addresses are set such that devices interact with their local D.C. (Subnets)
- Site link bridging can be setup based on a hierarcy (default all on)
- May wish to disable site link bridging where a site has multiple sub-sites

Configured and Managed via AD DS > Sites

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/Uyximage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/Uyximage.png)