3

I get asked the same question a lot. Why use multi-tree forests when designing Active Directory?

I know that the two trees will belong to different namespaces and that they will share Scheme/configuration partition/Forest FSMO roles etc.

why not use two forests with a Forest trust instead?

I would be keen to get real world examples of multi-tree designs being used today and why people are using them.

Thanks in advance.

1

The only reason to have a disjointed namespace is because you do not have control over the other DNS namespace OR have a need to separate control of the other namespace, while maintaining control over the AD objects on both. The issue wih disjoint namespaces is that most (if not all AD aware apps) use the assumption that the UPN suffix will be the same for all users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.