I've been working through some Exchange training documentation (the official MS e-learning package) and all of the design scenarios allude to placing at least one DC from your forest root domain in every site.

I'm not sure whether this just relates to Exchange, but I can think of a number of issues we experience in our forest that would be resolved by this. For example, a Microsoft support engineer has stated that EVERY client in a child domain (i.e. all workstations and member servers) need access to a forest root DC to check certificate/template permissions, even on a subordinate CA.

I have attempted to locate documentation or guidelines from Microsoft on this, but have not been able to find anything. I found the Domain Controller Placement guide, but it's only a form - you would use it to document where you will place your DCs, but it doesn't give any guidance on where you should deploy them.

Does anyone know where, or if, I can find any such documentation?

EDIT: To clarify, I'm wondering if there is any documentation (specifically from Microsoft) that anyone is aware of that states there is value in having a forest root domain DC in every site, even for sites that are otherwise exclusively for a child domain.

Specifically relating to the CA situation, the MS engineer who worked on a case we had open referenced this Technet blog post, where they describe an isse with every client (including workstations) requiring access to a DC in the forest root domain. But what I haven't been able to find is any design/architectural documentation from MS that suggests this design.

  • What is your question? This is more of a statement – Zapto Jul 11 '12 at 7:36
  • Sorry you are correct. I've updated the final paragraph. – Matt Jul 11 '12 at 7:48

This is a system requirement as you can read here:


"In each Active Directory site where you install Exchange 2010, Exchange 2010 must be able to contact at least one writeable domain controller of the domain of which Exchange 2010 is a member."

  • Just to clarify for the OP, that doesn't mean you need to install a writable DC at every ADDS site, just that every Exchange server has to be able to contact a writable DC for its domain. Plenty of smaller environments just have a DC at their primary site, and as long as their Exchange servers can contact it, they're fine. Also, as it relates to the CA tangent, CAs do not need to be placed on DCs. – HopelessN00b Jul 15 '12 at 13:41
  • Thanks, this wasn't really an Exchange question, just using it as an example. – Matt Jul 19 '12 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.