We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


Multi domain  VS  single domain infrastructure

mega666 asked
Medium Priority
Last Modified: 2012-05-06
Hi All,

I work for a company with offices in 7 countries worldwide. We will have to put a server in each office and of course connect them in a full mesh network.
We will have about 10 servers which users will have to connect with RDP (Terminal servers) and work on them. They have to be able to authinticate with no problems, hopefuly using their windows login credentials - hope all this makes sense.

Now the question :
Woudl you recommend having 1 global domain and then  have DC's in each office which replicate with all the other ones ?

Or maybe have 1 central DC with the main domain and then have sub-domains in each branch office and set up trusts between them ?

Please give your view as this is a bit new to me. I understand the rules of AD and the way tit works so don't worry to use technical terms. Any input will be really appreciated.

Thank you.
Watch Question

tigermattSite Reliability Engineer
Most Valuable Expert 2011


I would not recommend installing DCs which are made members of separate child domains. This only adds unnecessary complexity, confusion and makes you more susceptible to major issues if one of the DCs goes down.

Instead, I would suggest you create one Active Directory domain, and make all the DCs additional DCs in that domain. This way, everything replicates with every DC. Next, ensure every DC is a Global Catalog server, and that you properly configure sites and services in Active Directory. Install DNS on each DC, and you should then be good to go.

Deploying child domains is only really useful when you have lots and lots of users (as in thousands of users), or the business opens up a subsidiary which is mainly separate from the main company. Child domains for different offices isn't required and Active Directory is specifically designed such that you don't need to do this.



Cool, thanks for the comment.

Few question though :
1) with all the DC's replicating over the internet (as our branch offices are all over the world) won't it slow down the connections ? I have no idea how big is the traffic when DC's are replicating with one-another ?
2) Have anyone got experience with making their DC a file server as well ? I know DC's are under quite heavy load without giving them more tasks to do but again haven't got much experience in that field. The theory says it shouldn't matter but in real life it could be totally different  :)

Site Reliability Engineer
Most Valuable Expert 2011

The initial replication of Active Directory is the largest... in other words, the replication which occurs just after a DC is promoted. You would ideally promote DCs while they are connected to the same LAN as an existing DC, prior to shipping them to the remote office, so this would not be an issue.

General daily Active Directory replication traffic is not very large at all and should not cause any issues. If a particular office is on a very slow link, you can still adjust the replication timings to that site (in Active Directory Sites and Services) such that the replication would only take place out of hours.

DCs are not under very heavy load except perhaps in the most extreme networks with thousands of users. If you get a machine which is more than powerful enough in today's climate, you could easily make it a file server. The other option for larger offices could be to purchase a more powerful server, install Hyper-V or VMWare ESXi, and then virtualise a separate DC and File Server on that host (as if they are two separate systems).

The most important part is to get the hardware - CPU, RAM, storage, RAID array type and configuration and so on - spot on. If you do, you won't have a problem. Feel free to post a question on EE... and link me to it here if you wish... and we can help you determine what the requirements for doing this would be.


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts


Wicked, that's pretty much all I need to know :)

Thanks for the input.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.