What are the Best Practices for 1 forest, 1 child and 2 sites in child domain?

for each site it is recommended to get 2 DCs
if hardware is equal on all servers, pick one of the 2 DCs at the HQ office and make it FSMO role holder (remember that schema reside on the parent DC)
configure GC on all DCs (only with huge sizes it is recommended to separate FSMO from GC)
each site will have its own SITE under sites-and-services, each site will use a different networking subnet
install 1 DNS per site for redundancy and make the local DNS primary
if you're using DHCP you'll need 1 DHCP server per site

Hi there,

Is mycompany.local going to be an operational domain or a dedicated forest root? In a larger setup it's recommended to have a dedicated forest root holding no resources. It acts as the administrative head of the forest, with just your enterprise admin accounts and schema/domain naming masters residing there. This keeps the adminstrative core of the forest protected from any organisational re-shuffles the company may have in future (you cannot change the forest root ever, so it's best to make sure it's seperate from any potential moves/changes).

If you've just a smaller setup, then as Mike says, the less domains the better.

Just to add a couple more comments:

1. Ensure your PDC is well connected, and preferably in the site with the most users. The PDC is used for password changes/referals so it's the most heavily used FSMO from a user perspective. It's recommended to put the RID master on the same server as the PDC also.

2. With 2 domains, if you do not make all DCs global catalogs, ensure that you DO NOT place the Infrastructure Master on a GC. But again, as Mike has already mentioned, nowadays you can usually make all DCs GCs.

Tony

The mycompany.local is a dedicated root forest domain.  The child domain (corp.mycompany.local) will have two sites. A local site in Florida (site A) and a remote site in Texas (site B).  The design is to have 2 DC in the root forest and 2 DC in each site in the child domain.  There will be a GC in the root and each site as well.  We are looking to improve network performance by creating a child domain that will house our two sites. Also, we would then be able to delegate administration of the sites to the admins at that site, etc.  This is a new network that will be implemented in an existing company, included in this AD design is the implementation of Exchange 2007.  The Mailbox Servers will be be clustered (SCC).  The Exchange environment will reside in the root forest domain (mycompany.local).  I am setting this all up in a lab environment first with the goal of creating the production environment with the intent of a Q1 2010 implementation.  

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_24109142.html

Take a look at my comments about halfway down for step by step on creating the two sites, won't take you long for the two.

Thanks

Mike

Each site should be followed by dc & ADC.

Until its extremely required don't configure chil domain,as it will make the mamagement complex. Because resource access,permission related error & many more.

DNS should be configured as AD-integrated.

Each site should have atleast one Global catalogue.

Infrastructure master & GC should not be in same server.

http://technet.microsoft.com/en-us/library/bb727085.aspx

Why do you want the empty forest root domain? I thought this was a closed chapter by MS some years after the server 2000 release.

You don't gain much security by this design (over a populated forest root), extra HW is needed (in these "green IT days") and you got yourself more administrativ work.

SG

A dedicated forest root would be something you would use in a larger enterprise set up, and as far as I know still is MS best practice (at least it was for 2003 - can't say for 2008 myself).

If the plan is to have many child domains in a big forest, then a dedicated forest root would help. There is no real added admin as the forest root doesn't hold any resources. It just sits there holding your two forest FSMOs and enterprise accounts. In a large enterprise the added cost of hardware is relatively small in comparison to the overall cost of the enterprise.

The idea isn't to really just to gain security, it's to isolate the administrative head of the forest, leaving it protected from any organisational reshuffles in the future (as it can't be moved). I've come across quite a few posts on EE where people are asking about how to reshuffle their forest and it's not possible because the first domain in the forest was populated and couldn't be moved/removed (and wasn't actually the organisational head of the enterprise), leaving the only solution much more convoluted.

That said, if the plan is to just have one operational domain, then I would say a dedicated root isn't necessary for the reasons snusgubben says.