Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have the forest named "" and are debating between "" versus "thing.local". My understanding is that the latter is called a "Tree in a Forest"

What are the deciding criteria that will help me choose which is better? Is there any security, management, or GPO setting that favors one over the other?

share|improve this question
Correct, the latter choice would constitute a new tree in the forest (unless you create a new forest). What is the motivation behind an additional domain? – Mathias R. Jessen Mar 28 '12 at 23:29
Don't use .local or any other made up TLD! – MDMarra Mar 28 '12 at 23:50
@Jessen The motivation is to support CA Siteminder / Arcott which needs to separate LDAP accounts by "LDAP Containers" (something the Dev says). It is also to migrate features off of ADAM – LamonteCristo Mar 29 '12 at 0:23
Why not use OUs in that case? OUs are "separate" containers by most accounts. – David Mar 29 '12 at 0:36
@Dave Agreed, I'm creating an argument for this purpose, but it may be an internal fight not worth having. – LamonteCristo Mar 29 '12 at 0:52

There's no real difference other than the DNS namespace will be disjoint. The first domain (i.e. will remain as the forest root domain.

share|improve this answer
Do any policies inherit? (GPO or otherwise) – LamonteCristo Mar 29 '12 at 0:24
GPOs do not inherit between domains in a forest regardless of whether their DNS namespace is contiguous or not. Domains are a security boundary. – Chris McKeown Mar 29 '12 at 7:33
Not trying to troll, but Microsoft and NIST documentation both state that domains are not a security boundary, but that forests are. – SturdyErde Mar 29 '12 at 16:37
@SamErde Good catch, my bad! – Chris McKeown Mar 29 '12 at 21:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.