We currently have physically separate domain controllers

dc1.country1.company.com dc2.country1.company.com

dc1.country2.company.com dc2.country2.company.com

altogether 4 machines.

Now, there are many permission issues but since I am not good at AD at all, I can only suspect that these 2 domains are actually not aware that they are in the same company.com forest. Furthermore, we all users have to maintain 2 accounts country1\user and country2\user depending on where the service resides.

All I could find is that validated entry in "AD domain and trust" console where the domain countryX.company.com trust the other countryY.company.com (basically trusting each other, though I am not sure of the effects).

May I ask how can I confirm if the 2 domains are NOT set under the same forest? And upon confirming that, how to set up into one forest?

I looked at "AD sites and services" which seemed to be the place to set up the DC relationships but it seems that a separate physical server is required to be the DC for company.com. Is that the case or can I just set it up logically? Otherwise, I may have to treat these 2 sites as separate forest and look into full trust between them.


If your forest root domain is actually "company.com" then those domains would be in the same forrest. In that scenario your root would be "company.com" and then you would have two child-domains of "country1" & "country2." If it is not then they would be in two separate forests. Forest one would be "country1.company.com" and forest two would be "country2.company.com".

You can find what domain is the forest root by copying the following to notepad and saving it is as a .vbs file.

Set objSysInfo = CreateObject("ADSystemInfo")
Wscript.Echo "Forest DNS Name: " & objSysInfo.ForestDNSName

In a command prompt window navigate to the directory the file is saved and run the .vbs file with cscript <file>.vbs

Also, in order to create a new forest/ domain you will need a new server to act as a Domain Controller for that domain. It could be a virtual or physical but you cannot have a server act as a Domain Controller for two domains.

  • thanks for your help! so now I know domains are really considered as 2 separate forests. Just curious, what would the common practice be to situation the DC for company.com? Primary and Seconadry DC, one at each country?
    – Jake
    May 13 '11 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.