up vote 0 down vote favorite
share [g+] share [fb]

A colleague of mine wants to add a domain to our forest. He said it would be good for security. I believe him but I have no idea why it is any better than with just one domain. I read this on Wikipedia but it has no source:

"Microsoft recommends as few domains as possible in Active Directory and a reliance on OUs to produce structure and improve the implementation of policies and administration."

I have no idea if it's right or not. I was hoping for comments.

Thank you.

link|improve this question
57% accept rate
feedback

5 Answers

up vote 3 down vote

If your colleague said "It will be good for security" without justifying, qualifying, or quantifying his statement, he probably doesn't know what he's talking about. did he give you any details on his train of thought?

link|improve this answer
+1, (I wish I could do more than just +1) for calling people out on unjustified "Do it for the securities" BS. – Chris S♦ Apr 6 '10 at 15:54
feedback
up vote 3 down vote

Microsoft used to say that Domains were a security boundary but now they agree that the forest is really the security boundary. Having multiple domains is mainly used now for isolating traffic to specific regions (ex. East vs West, or Northamerica vs. Europe).

That being said, in many cases the choice to use multiple domains ends up being the wrong choice since it introduces the additional cost of servers and management.

OU's can be configured with delegation to isolate management and security tasks sufficient to meet almost any inter-forest security requirements.

My recommendation is that unless you have a siginificant network connectivitity difference between two separate locations stay with a single domain.

UPDATE: I also forgot to mention that Windows 2008 allows for OU level Password policies, making one of the primary reasons used for separate domains obsolete.

link|improve this answer
feedback
up vote 2 down vote

More domains equals more hassle and cost, unless:

  • you can't control who is domain administrator and you want different AD admin for some objects
  • some sort of government rules on where stuff runs or password rules
  • some non-technical bozo has their undies in a twist and "wants their own stuff" (try to fight this)
link|improve this answer
+1, Adding Domains genearlly doesn't improve security (compared to a properly configured single domain). – Chris S♦ Apr 6 '10 at 15:52
1  
The only part of this answer that is correct is the last bullet - politics always screws things up... OU's can be delegated to provide almost any required permissions... Password rules are no longer Domain bound... – Dscoduc Apr 6 '10 at 16:53
feedback
up vote 1 down vote

"He said it would be good for security," Is generally code for, "I don't trust the people in the Domain Admins group." I had some problems with this at my old job during our AD deployment. We ended up with three peer domains because of that, and everyone in the Enterprise Admins group had to go through a background check and get approval from each sub-domain before they were added.

link|improve this answer
feedback
up vote 0 down vote

I usually only do new domains for geographically separated business units, for the first reason echobeach2 mentioned: you want local admins to be able to admin their local domains, but you don't want them to have admin rights to ALL domains in the forest.

It's also a pain to have AD replication constantly running across a VPN tunnel, or whatever.

Otherwise, the fewer the better.

link|improve this answer
You'll still end up with GC replication traffic across the WAN, but happily that's a much smaller dataset. – sysadmin1138♦ Apr 6 '10 at 15:55
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.