I have 2 Windows 2008 R2 servers. One already has AD and DNS installed. It was set up as a new tree in a new forest.

Now I have to add the second server, which is to have a dns zone that the first server is delegating. The first server is foo.com and the second server will be bar.foo.com

During the setup, I choose "existing forest". It's not an extra domain controller, so I choose "create new domain in existing forest". Then I saw the option" Create a new domain tree root instead of a new child domain".

And it has me puzzled, because I don't know what the implications will be.

I used all my skills in MS Paint to create this diagram representation of the scenario: Diagram


I should preface this answer with a comment. I don't know your infrastructure, so please forgive me if this doesn't apply. Microsoft doesn't recommend child domains or separate tree roots for most organizations. The current recommendation is a single AD domain with business units separated by OUs for management. Unless you have a very compelling reason to complicate your AD structure by doing this, I suggest that you rethink your design and evaluate whether or not a single AD domain might be a better fit.


Above is an example of each. There is no explicit trust between the two domains in the 2nd example, There is still an implied trust, though.

You would have to use a trust shortcut between the two, otherwise the forest root would always have to be queried whenever a cross-domain resource request was made.

| improve this answer | |
  • thanks for the drawing. The drawing I made is exactly what i should be getting to. before configuring the second server, there is only foo.com and it should become as my drawing. So, new child domain, if I understand correctly. – Koen027 Nov 22 '11 at 15:38
  • @Koen027 Yeah, but do you really want to create a new child domain? Why not just add the new server to the same domain as the existing DC. – MDMarra Nov 22 '11 at 15:40
  • Because it's not on the same geographical location. Theoretically. In reality, it's 2 VMs on the same subnet. But it's supposed to be a separate server, managing users in a different geographic location, with their own admins, etc... all for practice. – Koen027 Nov 22 '11 at 15:54

The difference between a "New child domain" and a "New domain tree root" relates to continuity of the DNS namespace. A "New child domain" will have a name that is contiguous to the parent domain ("corp.foo.com" and "child.corp.foo.com") whereas a "New domain tree root" will have a name that is not contiguous to the parent domain ("corp.foo.com" and "research.foo.com").

| improve this answer | |
  • 1
    quoted: "The difference between a "New child domain" and a "New domain tree root"..." AWESOME!! I understood the physical structure, but, for some reason, I could figure the naming structure. Your answer made the two click perfectly. Thanks!! – user116817 Apr 8 '12 at 12:31
  • Glad I could help. I wish I could find time to play Server Fault. Too much work... >grumble< – Evan Anderson Apr 8 '12 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.