Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am designing an Active Directory with multiple domains. At this point I am trying to decide if our DMZ should be in a separate forest or in a separate domain. I recognize that some of this discussion is based on opinion, there are pluses and minuses to both approaches. The main focus is Securing the inside from the DMZ which will live on the internet with broad firewall rules. This is a new forest and will be Server 2008R2 functional, there are no legacy resources. There is also no email services in the environment.

The requirements are listed below in order of importance.

  1. Protect the inside network
  2. Provide Single Sign on (tests show this works fine in both cases)
  3. Provide maximum flexibility for differing security models. (End users do crazy things)
  4. Minimize complexity (I know this argues for single forest and contradicts #3)

I am leaning towards single forest, any one to argue the alternative?

share|improve this question
Why use a domain\forest in the DMZ at all? – joeqwerty Nov 22 '10 at 18:07
There a at least 25 servers and I did not want to have users manage that many passwords. – Tom Seibert Nov 22 '10 at 18:35
up vote 1 down vote accepted

From a security perspective, the single forest method obviously introduces some concerns. You'll need to weigh those when you're making your decision.

For me, the most obvious issue would be that in a single forest deployment, it's likely that the DC you place in the DMZ is going to be required to house the Global Catalog (GC) to effectively service the applications and users you're looking to reach. In that case, you've now placed a copy of every AD object in the entire forest onto that server. I'd be careful with that.

share|improve this answer
Yes, I am concerned about that. I've also deployed a DC without a GC but it makes usage difficult and introduces complexity. – Tom Seibert Nov 22 '10 at 18:37
Well you're asking the questions at the right time (the design phase). My gut would be to go with the secondary forest now if there's a probability that an application in the future is going to require a GC. The worst outcome is finding you need the GC for a new service later and then running both a secondary domain and forest in the DMZ. – CurtM Nov 22 '10 at 20:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.