1

I have been reading through the AD articles in here and still have a fog going about Sites compared to Child Domains.

I have been using a Windows 2012 R2 Domain and Functional level to manage a mini private cloud.

We wanted to make sure that users from one child domain could not see anything of any other child domains. We used segregated networking and child domain configs to accomplish this.

Having to stick an ADC in each Child domain is getting cumbersome and we want to convert to model that will allow for the same security segregation but central management.

I have kicked around the idea of separate OU's containing Computers and Users, but didn't think this was isolated enough.

Then I looked at Sites and this was more promising but revealed that I don't really understand the concept behind Sites as well as the benefits and pitfalls of them.

As I was reading through the articles here, I kept seeing reference to Child Domains being sort of pushed to the side in favour of a new model but couldn't connect the security isolation concept of a child domain to either an OU or a Site.

Is there anything or anywhere I cold go to get a much more in depth understanding of how and when to use either OU's or Sites?

6
  • 2
    Mike, general learning material recommendations are off-topic here, but I encourage you to please, break up your questions into separate, clearly answerable technical chunks and you will have a much better time here. :)
    – Ryan Ries
    May 5, 2015 at 19:14
  • 2
    Sites should be based on the physical architecture of the network. Sites help clients find a domain controller faster and give you the ability to control AD replication traffic over slow links. Sites have absolutely nothing to do with what clients can authenticate to what domains. technet.microsoft.com/en-us/library/cc782048%28v=ws.10%29.aspx May 5, 2015 at 19:15
  • 1
    OU's, Sites and Child Domains are not security boundaries. Can you elaborate on your need to make sure that users from one child domain could not see anything of any other child domains? What exactly don't you want them to see or access?
    – joeqwerty
    May 5, 2015 at 19:22
  • 2
    To truly segment your clients servers, they should all be in separate forests and domains. However, if you are managing the systems for them, that may not be what you want to do. An OU will give you the ability to set separate Group Policies, but you're not really going to segment the network with it. Honestly, I would recommend that you hire an AD expert for some high level design because if you do this in a suboptimal way someone will have to live with it forever, or tear it all down and redo it. May 5, 2015 at 19:23
  • 1
    @joeqwerty comments are spot on--you really need to define all of your requirements and get an informed, professional design. Just asking some questions here may lead you in the wrong direction because we don't know what all of your requirements are. May 5, 2015 at 19:24

2 Answers 2

1

Sites influence which domain controller a computer/user authenticates with, and which domain controller other domain controllers replicate with, and how often replication occurs. Sites typically follow some physical aspect of your infrastructure (although not necessarily).

Sites don't help partition a directory in a multi-tenant environment. That may need to be done with OU's, permissions, and some other carefully planned related settings. (Assuming what you are doing is feasible in a multi-tenant/single forest).

0

A site is a well connected set of subnets that is considered local to the DCs that have been designated aslocated in that site. Site membership of the client will determine which DC will authenticate that client and user.

Domains are namespaces that allow group policy to be applied to a large group of users and can be used to set a security context. Older literature designated domains as security boundaries but that is not the case.

An OU (organizational Unit) is an Active Directory construct that allows you to apply group policy to all of the members of that OU. OUs can also be used to delegate management rights.

From what you've said so far, separate Forests (which is a security boundary) with trusts (trusts allow you to securely use credentials from one forest to another) is probably the way to go for separation and control.

4
  • That's pretty much the model we are using as Child Domains end up with a two way trust with the parent only and can't see the other Child Domains. However that still leaves us with a pile of minimally used ADC's. Going to have to keep looking for an alternative method of central management and isolated security.
    – Mike Kelly
    May 6, 2015 at 11:47
  • Child domain aren't security barriers if anything you've introduced some interesting security vulnerabilities as well as support issues. I'm still failing to see any reason why these should not be separate forests managed by a central management forest with 2 way trusts where appropriate
    – Jim B
    May 6, 2015 at 14:47
  • We found two way trusts to be generally a pain to centrally manage, but that may be a perception problem. We also isolated the child domains with a router type of W2012R2 RRAS install. This still leaves us with the problem of ADC's sitting all over the place. A state we want to move away from. We were hoping an AD with multi-tenancy would alleviate this.
    – Mike Kelly
    May 7, 2015 at 14:06
  • A working, feasable and secure multitenant AD requires multiple forests.
    – Jim B
    May 7, 2015 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .