In Chapter 2, you learned to install Active Directory, which actually creates the initial domain, tree, and forest for an organization. However, some organizations might require multiple domains, trees, or forests for Active Directory to effectively meet their needs. This lesson shows you how to create additional domains, trees, and forests.
After this lesson, you will be able to
• Create additional domains, trees, and forests
• Explain the reasons for using multiple domains, trees, and forests
• Explain the implications for using multiple domains, trees, and forests
Estimated lesson time: 20 minutes
Creating Multiple Domains
You must determine the number of domains for each forest in your organization. Although one domain might effectively represent the structure of small or medium-sized organizations, larger and more complex organizations might find that one domain is not sufficient. Before adding any domains you should be able to state the purpose of the new domain and justify it in terms of administrative and hardware costs.
Reasons to Create Multiple Domains
As stated in Chapter 2, you should create multiple domains to
• Meet security requirements
• Meet administrative requirements
• Optimize replication traffic
• Retain Microsoft Windows NT domains
Tip Do not create multiple domains to accommodate polarized groups or for isolated resources that are not easily assimilated into other domains. Both the groups and the resources are usually better candidates for organizational units (OUs).
Creating Domains to Meet Security Requirements The settings in the Account Policies subdirectory in the Security Settings node of a Group Policy Object (GPO) can be specified only at the domain level. If the security requirements set in the Account Policies subdirectory vary throughout your organization, you need to define separate domains to handle the different requirements. The Account Policies subdirectory contains the following policies:
• Password policy Contains settings for passwords, such as password history,
age, length, complexity, and storage
• Account lockout policy Contains settings for account lockout, such as lockout
duration, threshold, and the lockout counter
• Kerberos policy Contains Kerberos-related settings, such as user logon restric¬
tions, service and user ticket lifetimes, and enforcement
You can learn more about Account Policies in Chapter 13, "Administering Security With Group Policy."
Creating Domains to Meet Administrative Requirements Some organizations might need to establish boundaries to meet special administrative requirements that cannot be accommodated by establishing OUs in one domain. Special requirements might include satisfying specific legal or privacy concerns. For example, an organization might have a privacy requirement that outside administrators not be given control over sensitive product development files. In a one-domain scenario, members of the Domain Admins predefined global group would have complete control over all objects in the domain, including the sensitive files. By establishing a new domain containing the files, the first Domain Admins group is outside of the new domain and no longer has control of the files.
Creating Domains to Optimize Replication Traffic In organizations with one or more sites, you must consider whether site links can handle the replication traffic associated with a single domain. In a forest with one domain, all objects in the forest are replicated to every domain controller in the forest. If objects are replicated to locations where they are not used, bandwidth is used unnecessarily. By defining multiple small domains and replicating only those objects that are relevant to a location, you can reduce network traffic and optimize replication. However, you must weigh the savings achieved by optimizing replication against the cost of hardware and administration for the additional domains.
To determine whether you should define a domain to optimize replication traffic, you must consider
• link capacity and availability If a link is operating near capacity or is not available for replication traffic during specific times of the day, it might not be able to handle replication traffic, and you should consider defining another domain. However, if links are idle at specific times, replication could be scheduled to occur during these times, provided the appropriate bandwidth is available.
• Whether replication traffic will compete with other traffic If a link carries
other, more important traffic that you do not want disturbed by replication traffic,
you should consider defining another domain.
• Whether links are pay-by-usage If replication traffic will cross an expensive
pay-by-usage link, you should consider defining another domain.
• Whether links are limited to Simple Mail Transport Protocol (SMTP) If a
location is connected by SMTP-only links, it must have its own domain. Mail-based replication can occur only between domains; it cannot be used between domain controllers in the same domain.
Creating Domains to Retain Windows NT Domains Organizations that have large Windows NT infrastructures might choose to retain an existing Windows NT domain. Existing Windows NT domains can be upgraded to Windows Server 2003, sometimes referred to as an in-place upgrade. You must weigh the costs of upgrading the Windows NT domain or consolidating the domain against the savings of maintaining and administering fewer domains. It is recommended that you minimize the number of domains by consolidating Windows NT domains before upgrading to Windows Server 2003.
Implications of Creating Multiple Domains Adding a domain increases administrative and hardware costs. When determining whether to create multiple domains, keep the following cost issues in mind:
• Domain administrators Each time a domain is added, a Domain Admins pre¬
defined global group is added as well. More administration is required to monitor
the members of this group.
• Security principals As domains are added, the likelihood that security princi¬
pals will need to be moved between domains becomes greater. Although moving a
security principal between OUs within a domain is a simple operation, moving
a security principal between domains is more complex and can negatively
affect users.
Note A security principal is a user, group, computer, or service that is assigned a unique security identifier (SID). Security principals are discussed in more detail in Chapter 9, "Administering Active Directory Objects."
Group policy and access control Because group policy and access control are applied at the domain level, if your organization uses group policies or delegated administration across the enterprise or many domains, the measures must be applied separately to each domain.
• Domain controller hardware and security facilities Each Windows Server
2003 domain requires at least two domain controllers to support fault-tolerance
and multimaster requirements. In addition, it is recommended that domain con¬
trollers be located in a secure facility with limited access to prevent physical access
by intruders.
• Trust links If a user from one domain must log on in another domain, the
domain controller from the second domain must be able to contact the domain
controller in the user's original domain. In the event of a link failure, the domain
controller might not be able to maintain service. More trust links, which require
setup and maintenance, might be necessary to alleviate the problem.
Creating Additional Domains
When creating additional domains, you use the Active Directory Installation Wizard. To create an additional domain, complete the following steps:
1. Restart your computer and log on as Administrator.
2. Click Start and then click Run. In the Run dialog box, type dcpromo in the Run
box and click OK.
3. On the Welcome To The Active Directory Installation Wizard page, click Next.
4. On the Operating System Compatibility page, click Next.
5. On the Domain Controller Type page, shown in Figure 4-1, select Domain Con-
troller For A New Domain, and then click Next.
6. On the Create New Domain page, shown in Figure 4-2, select Child Domain In An Existing Domain Tree, and then click Next.
7.on the network Gredentials page ,shown in figure4-3,type the user name, password, and domain of the user account that has permission to create the domain in the user name, password, and domain boxes, respectively, click next.
8. On the Child Domain Installation page, shown in Figure 4-4, type the name of the parent domain in the Parent Domain box, and then type the name of the child domain in the Child Domain box. Ensure that the full Domain Name System (DNS)
9. Proceed through the following Active Directory Installation Wizard pages in the same way you did in the "Installing Active Directory Using the Active Directory Installation Wizard" section of Chapter 2:
Q NetBIOS Domain Name
Q Database And Log Folders
Q Shared System Volume
Q DNS Registration Diagnostics
Q Permissions
a Directory Services Restore Mode Administrator Password
10. On the Summary page, shown in Figure 4-5, the options that you selected are listed. Note that the new child domain is indicated. Review the contents of the Summary page, and then click Next. The Configuring Active Directory progress indicator appears as the Active Directory service is installed on the server. This process takes several minutes.
About us