AD Forest vs Domain

[Alex Hose]

What is the difference between a AD forest and AD domain?

Specifically, what are the restrictions to the user accessing the resources within the same forest vs accessing the resources in different forest.

[Melissa Schaefer]

You might want to check out Microsoft's Forum for Server 2003.

A domain exists within a Forest.

http://www.microsoft.com/technet/community/newsgroups/serveros/win2003.mspx


Here is a white paper on Multi-Forests
http://www.microsoft.com/downloads/details.aspx?FamilyID=b717bfcd-6c1c-4af6-8b2c-b604e60067ba&DisplayLang=en

Here are some Best Practices
http://www.microsoft.com/downloads/details.aspx?FamilyID=631747a3-79e1-48fa-9730-dae7c0a1d6d3&DisplayLang=en

[Thomas Bianco · Accepted solution]

a Domain is a specific security authority.

domains, usually defined by a DNS name (MYDOMAIN.MYCOMPANY.ORG), contain OU's, User and computer Accounts, and GPO's. some of the FSMO's are domain specific, like PDCEmu.

a Tree is a group of connected domains, in the above example, Mydomain is a member (branch) of the Mycompany tree. all members of a tree trust each other, but other then that they're nothing special.

a forest is a group of 1 or more trees, that all share the same network (landscape) and Schema (growth rules). tree's need not trust eachother, but it really helps if they do. Multi-tree forests are discouraged, and multiforest companies are outright wrong.

hope this helps