[Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 535
  • Last Modified:

AD Parent/CHild domains

I have seen some environments where they create a Parent AD domain and a child domain, but most of the objects are in the child domain. I don't know if the purpose of this design is just for Management or security purposes.

Any idea?
3 Solutions
Ehab SalemCommented:
Ehab SalemCommented:
Krzysztof PytkoActive Directory EngineerCommented:
Yup, this kind of relation parent -> child domain is for "magement" functionality. You create forest root domain and then child domain(s) where all users and resources are created.

This scenarion fits mostly to large companies because it needs to spend some more money for licences.
And of course, it may be also treat as security reson. When you have no users and resources in parent domain then is lower possibility to do a mess during daily administration.

If you have more questions, do not hesitate to ask.

Mike KlineCommented:
A big reason this was done in the past is because people used the empty root design because of security concerns.  The idea was to separate groups like the enterprise and schema admins.

The common belief in the early days was that the domain was the security boundary but we now know that the forest is the boundary.

Check out this article from 2002   http://www.windowsitpro.com/article/exchange-2000-server/using-an-empty-root-domain-in-ad-forests

...again common thinking back then and a lot of folks still believe it today.

If you run into an empty root domain I'd just leave it as is.  Some people want to migrate but to me that is a lot of work to get rid of an empty root.


jskfanAuthor Commented:
thank you guys!

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now