Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am building out a sharepoint environment, which would have dev/prod domains. However, I will also be hosting a number of infrastructure servers in the network such as WSUS, DHCP, WDS, etc.

I am thinking that I can create two child domains under a parent domain called say INFRASTRUCTURE, which comprise of the respective dev and prod sharepoint environments.

Is there any flaw in this design? It's either this or 3 seperate flat domains under the forest.


share|improve this question
Why do you need multiple domains? Why can't DEV and PROD live in the same AD domain? – joeqwerty Jan 25 '13 at 1:45
To add to @joeqwerty's point, I think you are approaching the question as a web developer. An active directory domain is not a physical representation of a specific set of resources as opposed to a website/app domain which is a physical end-point. An AD domain is a collection of data, resources, and clients. You may want to pick up one of William Stanek's books on Windows Server and read the sections of Active Directory, it is often very helpful in understanding how things should be broken out. – Brent Pabst Jan 25 '13 at 1:55

Domains in the same forest are management boundaries. Separate forests are security boundaries.

If your concern is management, use separate domains (child or disjoint doesn't matter much). If your concern is security, use separate forests with a trust if necessary. If your concern is neither, you probably don't need a separate domain. We can't answer this for you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.