- Domain Design Overview
- Choosing Your Domain Namespace
- New Domain Design Features in Windows .NET Server 2003
- Choosing Your Domain Structure
- Single Domain Model
- Multiple Subdomain Model
- Multiple Trees in a Single Forest Model
- Federated Forests Design Model
- Peer-Root Domain Model
- Placeholder Domain Model
- Special-Purpose Domains
- Renaming an Active Directory Domain
- Summary
- Best Practices
This chapter is from the book
This chapter is from the book
This chapter is from the book
Special-Purpose Domains
A special-purpose domain or forest is one that is set up to serve a specific need. For example, your organization may set up a special-purpose domain to house outside contractors or temporary workers to limit their exposure to the main Active Directory forest. In addition, trust relationships could be established between this domain or domains to allow for resource access.
Generally, there has to be a good reason before additional domains are deployed in Active Directory. Overhead is increased with each domain that is added to an environment, and your logical network structure begins to look convoluted. However, in some unique cases, a special-purpose domain may become necessary.
Another possible use for a separate special-purpose domain structure is to house a directory service–capable application that requires itself, for security or other reasons, to have exclusive access to the schema. In other words, if your HR department runs an application that stores confidential employee information in an application that utilizes an LDAP-compliant directory, such as Active Directory, a domain could be set up for that application alone. A cross-forest trust relationship can be established to allow for the sharing of information between the two environments. This type of situation is rarer because most of these applications make use of their own directory, but it is possible. Because the Active Directory schema must be unique across the forest, this would preclude the use of a single forest if these applications require exclusive access or utilize common schema attributes.
Real-World Design Example
Company E is a computer consulting firm headquartered in Morioka, Japan. Most consulting work is performed by full-time Company E employees; however, some outside contractors are brought in from time to time to help on projects. The company had already deployed Active Directory for the internal organization but was concerned about opening access to the forest for any nonemployees of the company. Consequently, a single domain Active Directory implementation was created for the nonemployees to use. A cross-forest trust was established between this domain and the internal forest, and access to resources such file and print were delegated and controlled by the central IT organization.
Users in the contractor domain can access resources in the main companye.com domain, but only those that they are specifically granted access to. In addition, the exposure that the main companye.com domain receives from nonemployees is greatly reduced.