Windows Forum

Ask something
Discussion Locked

Domain Forest

0 helpful
4 replies

by jairomcnally

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have several questions all of them related to the creation of a domain forest.
I have two domains and need to create a third one. I will take a W2K domain controller and demote it to stand alone so I can create the forest by making this machine a domain controller for the main domain that will authenticate users and computers. If the other two domains are resource domains, do I need to create user accounts in the resource domains? Or should I only use the domain local groups?
Is there any other configuration that has to take place in a domain forest other than the creation of transitive trusts from and to the resource domains?
I wish to simplify the configuration of the forest by only one DHCP server? (at the main authenticating domain). Do I need to use different subnets?
Do I need to configure a dns server in each domain or should I use the single dns in the main or master domain with the users?
Is there any other things to consider for this setup to work? I will have all users and computers logging on to the main domain and will create a dfs to simplify access to all the resource directories. I may have to map two shares (database applications).
Any advice is welcomed!

4 replies

by joseph moore

Ok, let me get this straight. 2 resource domains are set up and running Active Directory. There are only printers and machines in these two domains. No user accounts. Ok. Are these 2 domains child domains, or is one the first domain and the other a child of it? Sounds like one domain is the parent domain. Let's call 'em domain.local and stuff1.domain.local
Now, you are gonna make a new domain to house your user accounts. Let's call this one user.domain.local
Here is the Forest structure simplified:

domain.local
/ \
stuff1.domain.local user.domain.local
(I hope this comes out halfway decent in the web page!)

Ok. The default domain trust relationship in 2000 is 2-way transitive. So, stuff1.domain.local will be able to reach user.domain.local WITHOUT setting up a exclusive trust between the two. That takes care of that.

No, you don't need user accounts in stuff1.domain.local or in domain.local. Just build all of your user accounts,OUs, groups in user.domain.local

With AD running, you can set up global groups in user.domain.local, then add them to local groups in domain.local and stuff1.domain.local. Remember, Microsoft loves it when global groups (and universal groups) areput in local domain groups. It makes them happy!

You could keep all machines in the same subnet to make your DHCP assignment easier. Same Site too.

You could use the single DNS server in the one domain, and it could handle all DNS requests forall 3 domains. This server would be the root server for all of your domains. That is fine. The DNS setup might be a little harder this way, but it is possible.

Hope this helps.

by joseph moore

Ok, the AD Forest diagram I tried did NOT come out at all! Well, let's try it again:

****************domain.local
****************/**********\
stuff.domain.local*****user.domain.local

Using * instead of spaces.

This discussion is closed to new replies.