Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 283
  • Last Modified:

Designing new AD structure

Hi

We are shortly going to be creating a new business unit, that requires a seperate AD forest from ours, so are thinking of potential designs for their AD 2008 structure.

Basically, they will have offices in emea, apac, usa and latam - multiple offices in multiple countries. They will have one Exchange org.

Some of my team are saying that we should create:

i) forest root: domain.com
ii) child domains of: emea.domain.com, apac.domain.com, usa.domain.com and latam.domain.com

However, I can't see the benefit of this - why not just one domain; domain.com, and split the continents into OU's, and have sub-OU's for the country etc?

Can anyone tell me the benefit of having multiple domains? The only one I can think of is password policy, since this is set in the Default Domain Policy, but I can't see that being an issue for us (unless apac want their own password policy to emea, say).
0
Joe_Budden
Asked:
Joe_Budden
3 Solutions
 
DesertCrocCommented:
Unless you have specific security policies that are requiring you to have separate domains I'd recommend not doing this as you then introduce the more complexity to a fairly simple design. In 2008 you do have more granular control of password policies than in 2003 so that's not an issue anymore either....usually only politics is the reason these days unless the number of objects is massive.
0
 
robertodeacruzCommented:
You are who will manage all areas? If there is a different administrator for EMEA, APAC, USA and LATAM domains will be advantageous to have multiple domains. If not, the best is even a single domain.

If the administrator is unique and also the policies, there is no reason to decentralize.
0
 
Joe_BuddenAuthor Commented:
Thanks guys -

Out of interest, how do multiple domains affect AD replication traffic?
0
 
Darius GhassemCommented:
You hit on the head in your post really there isn't a crazy amount of benefits using subdomains compared to OUs really it is preference and my preference is to keep everything in OU structure if there is not a company policy that requires different name spaces for each regional location. The one downfall is that you would have to create delegated rights to the local admins for their OU structure but once you create this you will have a more secure domain since local admins are not limited to your delegated controls and not domain admin rights like most companies give when they are in a multi-domain environment.

Replication is dependent AD Sites and Services nothing to do with your logical domain structure.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now