Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have the forest named "company.com" and are debating between "thing.company.com" versus "thing.local". My understanding is that the latter is called a "Tree in a Forest"

What are the deciding criteria that will help me choose which is better? Is there any security, management, or GPO setting that favors one over the other?

share|improve this question
    
Correct, the latter choice would constitute a new tree in the forest (unless you create a new forest). What is the motivation behind an additional domain? –  Mathias R. Jessen Mar 28 '12 at 23:29
2  
Don't use .local or any other made up TLD! –  MDMarra Mar 28 '12 at 23:50
    
@Jessen The motivation is to support CA Siteminder / Arcott which needs to separate LDAP accounts by "LDAP Containers" (something the Dev says). It is also to migrate features off of ADAM –  makerofthings7 Mar 29 '12 at 0:23
    
Why not use OUs in that case? OUs are "separate" containers by most accounts. –  Dave Mar 29 '12 at 0:36
    
@Dave Agreed, I'm creating an argument for this purpose, but it may be an internal fight not worth having. –  makerofthings7 Mar 29 '12 at 0:52
add comment

1 Answer

There's no real difference other than the DNS namespace will be disjoint. The first domain (i.e. company.com) will remain as the forest root domain.

share|improve this answer
    
Do any policies inherit? (GPO or otherwise) –  makerofthings7 Mar 29 '12 at 0:24
    
GPOs do not inherit between domains in a forest regardless of whether their DNS namespace is contiguous or not. Domains are a security boundary. –  Chris McKeown Mar 29 '12 at 7:33
    
Not trying to troll, but Microsoft and NIST documentation both state that domains are not a security boundary, but that forests are. –  SturdyErde Mar 29 '12 at 16:37
    
@SamErde Good catch, my bad! –  Chris McKeown Mar 29 '12 at 21:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.