Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have multi domain Active Directory forest with a few external trusts. Let's say we have forest root domain named and a few child domains in that forest -, and We are creating firewall rules that will restrict communication to domain controllers of from networks of subsidiaries.

Is there any article from Microsoft that describes required network connectivity (opened ports in firewalls) between workstations/member servers and domain controllers of other domains of the same forest required for proper operation of AD infrastructure itself? Some information on this topic is here:
How to configure a firewall for domains and trusts
How Domain and Forest Trusts Work

However these articles don't answer my question - is access to domain controllers of forest root domain from all workstations (and member servers) of all forest domains required?
I know that practically most things (except, for example domain authentication from MacOS workstations) are working fine if DCs of forest root domain (as well as all other domains, except domain where user and computer resides) are not accessible from workstations, but I would like to look at any official information from Microsoft or to hear opinion of administrators who have long experience with running such configurations.

share|improve this question

No - clients only need access to the domain controllers for their domains. The DCs need to be able to talk but that can be routed through bridgehead DCs so there is no need for ports opened between all participants.

You should look at your global catalog server distribution to make sure clients have access to the data from other domains they need to function.

There is a lot to know about AD in large environments. I would start here:

and consider a copy of this AD book:

share|improve this answer
Thanks! We have at least one GC server in each site. Have you had any such deployment in real life? – DavisNT Jun 8 '12 at 13:42

Some US government agencies have a parent forest root domain that is accessible only over an IPSEC connection from the designated bridgehead domain controllers. There is no ip connectivity between child domains or even from the child domain to the forest root domain. This is perfectly acceptable.

share|improve this answer
Thanks! This basically answers my question. – DavisNT Jun 8 '12 at 14:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.