
close
close
Updated 6/17/2013 – 8:30am MT: [Editor’s Note – This article has been updated and revised by the author to more accurately reflect current best practices with regards to Active Directory administration and security.]
It’s long been considered best practice to create a dedicated forest root domain at the top of the Active Directory (AD) hierarchy. Often referred to as an empty root domain, a dedicated root domain doesn’t contain any groups or user accounts.
advertisment
In a child domain, users that belong to the Domain Admins and built-in Administrators groups cannot elevate privileges to Enterprise or Schema Administrator using standard administration tools, preventing them from obtaining unrestricted access to the forest, including the ability to make changes to the AD schema.
Unlike in Windows NT, where the domain was considered to be the security boundary, in Active Directory, forests are the security boundary. This is because it has been shown that a resourceful administrator in a child domain could potentially elevate privileges to Enterprise or Schema Administrator.
Complexity and politics
If you decide not to use a dedicated forest root domain in your AD design you will need to select a regional or country domain to be the forest root, which some organizations prefer to avoid to prevent one domain being authoritative. Additionally, dedicated forest root domains are protected from organizational changes, potentially making restructuring the forest easier in the event of a company reorganization, takeover or merger.
advertisment
Using a dedicated forest root domain provides limited security benefit and shouldn’t be implemented in every AD design scenario. A dedicated forest root creates additional cost, complexity, and administrative overhead, so consider whether the disadvantages are worth bearing in exchange for greater flexibility.
From a security perspective, you should always limit the number of domain administrator accounts in a domain. Only grant administrative privileges for a specific purpose and limited time period using an appropriate change control process. This will limit exposure to forest service accounts, help track changes made to your IT systems, and aid in any post-incident investigations.
Keep it simple
Wherever you can, keep your AD design as simple as possible. If you can restrict your forest to a single domain, do so. Only add a dedicated forest root domain if the advantages outlined above are deemed to be of real benefit or a business requirement. The same goes for adding additional domains to your forest, only do so if there are administrative or technical reasons for the decision, such as the need to limit the amount of replication traffic.
advertisment
More from Russell Smith
advertisment
Petri Newsletters
Whether it’s Security or Cloud Computing, we have the know-how for you. Sign up for our newsletters here.
advertisment
More in Active Directory
Microsoft Rolls Out Azure AD Verifiable Credentials Service to More Customers
May 11, 2022 | Rabia Noureen
Best Practices for Installing Active Directory Domain Controllers in a Virtual Machine
Apr 15, 2022 | Michael Taschler
Most popular on petri
Log in to save content to your profile.
Article saved!
Access saved content from your profile page. View Saved
Join The Conversation
Create a free account today to participate in forum conversations, comment on posts and more.
Copyright ©2019 BWW Media Group