Learn What IT Pros Need to Know About Windows 11 - August 26th at 1 PM ET! Learn What IT Pros Need to Know About Windows 11 - August 26th at 1 PM ET!
Active Directory

Dedicated Forest Root Domains in Active Directory

Should I include a dedicated forest root domain in my Active Directory design?

Updated 6/17/2013 – 8:30am MT: [Editor’s Note – This article has been updated and revised by the author to more accurately reflect current best practices with regards to Active Directory administration and security.]

It’s long been considered best practice to create a dedicated forest root domain at the top of the Active Directory (AD) hierarchy. Often referred to as an empty root domain, a dedicated root domain doesn’t contain any groups or user accounts.

In a child domain, users that belong to the Domain Admins and built-in Administrators groups cannot elevate privileges to Enterprise or Schema Administrator using standard administration tools, preventing them from obtaining unrestricted access to the forest, including the ability to make changes to the AD schema.

Unlike in Windows NT, where the domain was considered to be the security boundary, in Active Directory, forests are the security boundary. This is because it has been shown that a resourceful administrator in a child domain could potentially elevate privileges to Enterprise or Schema Administrator.

Sponsored Content

Read the Best Personal and Business Tech without Ads

Staying updated on what is happening in the technology sector is important to your career and your personal life but ads can make reading news, distracting. With Thurrott Premium, you can enjoy the best coverage in tech without the annoying ads.

Complexity and politics

If you decide not to use a dedicated forest root domain in your AD design you will need to select a regional or country domain to be the forest root, which some organizations prefer to avoid to prevent one domain being authoritative. Additionally, dedicated forest root domains are protected from organizational changes, potentially making restructuring the forest easier in the event of a company reorganization, takeover or merger.

Using a dedicated forest root domain provides limited security benefit and shouldn’t be implemented in every AD design scenario. A dedicated forest root creates additional cost, complexity, and administrative overhead, so consider whether the disadvantages are worth bearing in exchange for greater flexibility.

From a security perspective, you should always limit the number of domain administrator accounts in a domain. Only grant administrative privileges for a specific purpose and limited time period using an appropriate change control process. This will limit exposure to forest service accounts, help track changes made to your IT systems, and aid in any post-incident investigations.

Keep it simple

Wherever you can, keep your AD design as simple as possible. If you can restrict your forest to a single domain, do so. Only add a dedicated forest root domain if the advantages outlined above are deemed to be of real benefit or a business requirement. The same goes for adding additional domains to your forest, only do so if there are administrative or technical reasons for the decision, such as the need to limit the amount of replication traffic.


Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (1)

One response to “Dedicated Forest Root Domains in Active Directory”

  1. What is an Add On Domain?

    [...] web site. After your domain registration, the add on domain gathers the information from the sub-domain directory using the same space and bandwidth as your main account but cannot have its own separate control [...]

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.

Register for Advanced Microsoft 365 Day!

GET-IT: Advanced Microsoft 365 1-Day Virtual Conference - Live August 24th!

Join us on Tuesday, August 24th and hear from Microsoft MVPs and industry experts about how to take advantage of Microsoft 365 at a technical level and dive deep into the features and functionality that will make your environment more secure and compliant.


Sponsored By