I've been working through some Exchange training documentation (the official MS e-learning package) and all of the design scenarios allude to placing at least one DC from your forest root domain in every site.
I'm not sure whether this just relates to Exchange, but I can think of a number of issues we experience in our forest that would be resolved by this. For example, a Microsoft support engineer has stated that EVERY client in a child domain (i.e. all workstations and member servers) need access to a forest root DC to check certificate/template permissions, even on a subordinate CA.
I have attempted to locate documentation or guidelines from Microsoft on this, but have not been able to find anything. I found the Domain Controller Placement guide, but it's only a form - you would use it to document where you will place your DCs, but it doesn't give any guidance on where you should deploy them.
Does anyone know where, or if, I can find any such documentation?
EDIT: To clarify, I'm wondering if there is any documentation (specifically from Microsoft) that anyone is aware of that states there is value in having a forest root domain DC in every site, even for sites that are otherwise exclusively for a child domain.
Specifically relating to the CA situation, the MS engineer who worked on a case we had open referenced this Technet blog post, where they describe an isse with every client (including workstations) requiring access to a DC in the forest root domain. But what I haven't been able to find is any design/architectural documentation from MS that suggests this design.