The difference between “new domain tree root” and “new child domain”?

Question

I have 2 Windows 2008 R2 servers. One already has AD and DNS installed. It was set up as a new tree in a new forest.

Now I have to add the second server, which is to have a dns zone that the first server is delegating. The first server is foo.com and the second server will be bar.foo.com

During the setup, I choose "existing forest". It's not an extra domain controller, so I choose "create new domain in existing forest". Then I saw the option" Create a new domain tree root instead of a new child domain".

And it has me puzzled, because I don't know what the implications will be.

I used all my skills in MS Paint to create this diagram representation of the scenario:

Answer 1

I should preface this answer with a comment. I don't know your infrastructure, so please forgive me if this doesn't apply. Microsoft doesn't recommend child domains or separate tree roots for most organizations. The current recommendation is a single AD domain with business units separated by OUs for management. Unless you have a very compelling reason to complicate your AD structure by doing this, I suggest that you rethink your design and evaluate whether or not a single AD domain might be a better fit.

Above is an example of each. There is no explicit trust between the two domains in the 2nd example, There is still an implied trust, though.

You would have to use a trust shortcut between the two, otherwise the forest root would always have to be queried whenever a cross-domain resource request was made.

Answer 2

The difference between a "New child domain" and a "New domain tree root" relates to continuity of the DNS namespace. A "New child domain" will have a name that is contiguous to the parent domain ("corp.foo.com" and "child.corp.foo.com") whereas a "New domain tree root" will have a name that is not contiguous to the parent domain ("corp.foo.com" and "research.foo.com").