Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm quite experienced with AD/MS Exchange etc when it comes to a single AD domain. What I'm not sure about is how I "should" set up AD when taking over IT for several daughter companies of ours.

They all want the same basic services (AD, Exchange, Terminal Servers) etc. We probably have to separate them into isolated TS enviroments due to special applications being installed, but other than that I can't really see any reason to use subdomains in AD (it will require us to have much more DC's).

Are there anything I should be aware of before using a single domain for this? Are there benefits to child setups/trusts etc that I dont know about?

share|improve this question
up vote 1 down vote accepted

Because of the additional overhead involved, I would recommend against a multi domain forest, except for the following reasons:

  1. You have a business, legal, or political need to maintain separate domains

  2. You have poor\unstable connectivity issues between companies that can't be resolved

  3. You need to implement different password policies if this is a W2K3 domain\forest

share|improve this answer
Luckily, we dont have any legal issues wich could prevent this (atleast not that I know of). We probably have to tighten things up when it comes to NTFS/database access to prevent dipping into another companys sales system. This is a 2008 R2 shop, so password policies should work out fine (GPO i pressume)? Perhaps a read-only DC could be deployed where we have unstable connectivity. – pauska Oct 9 '10 at 15:20

Ideally your directory service will reflect your organizational structure and administration will reflect the hard and soft links between various departments in charge of IT. Since you are assuming control of IT for these other companies, it makes sense to keep everything in one hierarchy. Any administrative authorizations and controls you need to implement should be easily manageable in the context of one AD domain. A few years ago I would have been worried about scalability, but for recent versions of AD you should be fine. Your plan seems to be the best option, provided there are no other extenuating circumstances.

share|improve this answer
Yeah, we're doing both IT and financial for all companies. Thanks for the response. – pauska Oct 9 '10 at 15:20

Set up a cross-link trust between the two forests in the first place, to allow early cross-forest resource access, then migrate users and computers to your domain as a project.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.