1. Understanding the Forest
A forest is the top-level Active Directory structure, composed of one or more domain trees. Each tree shares a common schema and global catalog but may have different namespaces. The root domain is the first domain created and often holds critical roles such as Schema Master and Domain Naming Master. Forests unify multiple trees, enabling scalability and centralized management.
2. Child Domains
Child domains are subordinate domains within a tree structure. They inherit attributes and policies from their parent domain but maintain their own identity. This hierarchical model simplifies resource management and delegation of administrative tasks.
3. FSMO Roles
Active Directory assigns five FSMO roles, divided into forest-wide and domain-wide categories:
- Schema Master (forest-wide): Manages directory schema consistency.
- Domain Naming Master (forest-wide): Ensures unique domain names.
- RID Master (domain-wide): Allocates SIDs for new security principals.
- PDC Emulator (domain-wide): Handles password changes and time synchronization.
- Infrastructure Master (domain-wide): Updates cross-domain object references.
FSMO roles are single-master but flexible, meaning they can be transferred to other DCs if needed.
4. Domains vs Workgroups
- Workgroup: Peer-to-peer architecture, each computer manages its own resources. Suitable for small networks.
- Domain: Client/server architecture with centralized management by a Domain Controller. Suitable for large, complex environments.
Comparison Table:
| Domain | Workgroup |
|---|---|
| Uses a dedicated server for management | No dedicated server required |
| Example: Client/Server network | Example: Peer-to-Peer network |
Conclusion
Understanding forests, child domains, FSMO roles, and the distinction between domains and workgroups is essential for building secure, scalable, and efficient Active Directory infrastructures in Windows Server 2025.