Dedicated root domain in active directory

[Frantic]

Hi, Need some advice about active directory infrastructures. Is there anyone who has experience of Dedicated root domain in active directory.

[Rune J. Winje]

There are both pros and cons.

Securitywise it will not make a big difference, except if you require different password policies etc which can only be set per domain.

Central administration and "political" issues can find easier acceptance with a dedicated root domain. Also it can be an advantage when companies expect to see strong growth or already are large.

http://networking.earthweb.com/netsysm/article.php/10954_3084961_3

Also it is beneficial in upgrade scenarios
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dssbf_upwn_xzjs.asp
(and presumably even more beneficial if there comes tools for pruning and grafting AD domains/forests - but that is strictly a guess on my part)

Weighted against this is the extra servers needed and the extra maintenance/administration that needs to be taken into account.

http://www.winnetmag.com/Article/ArticleID/41271/41271.html

The main reason to go for the dedicated root domain in my opinion is related to the size of the company/organization. Large size implies complexity and it is then good to have a relatively unchanging and simple root domain which all the subdomains can rely on. The size will then also justify implementing highly fault tolerant installations in the dedicated root domain.


Cheers,
Rune