Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have physically separate domain controllers

altogether 4 machines.

Now, there are many permission issues but since I am not good at AD at all, I can only suspect that these 2 domains are actually not aware that they are in the same forest. Furthermore, we all users have to maintain 2 accounts country1\user and country2\user depending on where the service resides.

All I could find is that validated entry in "AD domain and trust" console where the domain trust the other (basically trusting each other, though I am not sure of the effects).

May I ask how can I confirm if the 2 domains are NOT set under the same forest? And upon confirming that, how to set up into one forest?

I looked at "AD sites and services" which seemed to be the place to set up the DC relationships but it seems that a separate physical server is required to be the DC for Is that the case or can I just set it up logically? Otherwise, I may have to treat these 2 sites as separate forest and look into full trust between them.

share|improve this question
up vote 6 down vote accepted

If your forest root domain is actually "" then those domains would be in the same forrest. In that scenario your root would be "" and then you would have two child-domains of "country1" & "country2." If it is not then they would be in two separate forests. Forest one would be "" and forest two would be "".

You can find what domain is the forest root by copying the following to notepad and saving it is as a .vbs file.

Set objSysInfo = CreateObject("ADSystemInfo")
Wscript.Echo "Forest DNS Name: " & objSysInfo.ForestDNSName

In a command prompt window navigate to the directory the file is saved and run the .vbs file with cscript <file>.vbs

Also, in order to create a new forest/ domain you will need a new server to act as a Domain Controller for that domain. It could be a virtual or physical but you cannot have a server act as a Domain Controller for two domains.

share|improve this answer
thanks for your help! so now I know domains are really considered as 2 separate forests. Just curious, what would the common practice be to situation the DC for Primary and Seconadry DC, one at each country? – Jake May 13 '11 at 5:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.