0

As far as I know, a child domain's fully-qualified domain name (FQDN) must be a subdomain of the parent domain's FQDN. Also an implicit trust (two way - transitive) is established between them.

Are there any differences between the child domain and a parent domain? Are there any things that a parent domain can control or do to a child domain that a child domain can't do to a parent domain?

3
  • The domains don't exert control over eachother -- the accounts delegated or configured with appropriate administrative access do.
    – Semicolon
    Oct 14, 2021 at 18:43
  • Active Directory supports disjointed namespaces. The DNS namespace of a child domain may be different than the parent domain.
    – Greg Askew
    Oct 15, 2021 at 16:03
  • 1
    A domain in a disjointed namespace is by definition NOT a child domain.
    – Semicolon
    Oct 16, 2021 at 1:04

1 Answer 1

0

No, the domains each provide a security boundary and don't do anything to each other. The forest config, however, may affect both domains.

The main practical difference is that, by default, members of Domain Admin in the root domain may add themselves to Enterprise Admins and do the tasks allowed by that role. Of course, members of any child domain can be added to Enterprise admins as well. Anyone who is a member of Enterprise Admin has full admin rights to child domains.

Outside of Enterprise Admin, though, anyone who needs to access resources in a different domain needs to be granted explicit permissions. You should understand how to use AD groups and groups scope (like Universal vs Global vs DomainLocal) if you need to manage access to resources between domains.

You should always carefully consider why you might want a child domain at all. Other than perhaps academic environments (e.g to easily separate staff resources from student accounts) or similar limited use-cases such as very large enterprises, there aren't many scenarios where they'd be highly desirable. Remember, more domains = more DCs = more management and maintenance overhead. Also, if you plan to or are currently using cloud services like Office365, etc, that can cause additional complexity.

Much of what people tend to use child domains for can be done by better OU management and decent role definitions and rights delegations.

2
  • You said ' Anyone who is a member of Enterprise Admin has full admin rights to child domains ' . I saw that Enterprise Admin has control over all the Domains in the forest regardless of the child or parent relationship. Is it?
    – Allan
    Oct 18, 2021 at 14:24
  • Sorry, yes. All domains in the forest including the root- "children of the forest" was kind of how i was thinking of it.
    – LeeM
    Oct 19, 2021 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .