Windows Server

Archibald · Guest

We have 3 geographical locations with one root domain and AD. We want to
incorporate the 2 remaining sites into our AD infrastructure. Should we
create an organisational unit for each site or a child tree.
I have to mention that each site will be managed locally (so no centralised
management at root level) and each site will have its own DNS (root site:
blah.com; site 1: site1.blah.com; site 2: site2.blah.com).
Which would be the arguments to choose for a child tree or an OU?
Any help is greatly appreciated.

Paul Bergson · Guest

Are they going to want to have different password policies? Only 1 can be
defined per domain

Are they going to have the skill set to manage their own site or just
maintain users issues? Are they prepared to manage their own Disaster
recovery? Will they secure their environment to the level that is
acceptable to your organization? Will they control who gets to be an admin
or will they hand the keys to the kingdom to a lot of folks?

None of this takes in to account the network infrastructure you may or may
not have and how that can dictate your needs.

I guess in the end a lot of issues can be built for one side or the other.
If you want a separate name space though you will have to give them a
separate domain, you can't do that with ou's.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

Archibald · Guest

Hi Paul,

Thanks for the reply. The skills to manage the sites and disaster recovery
should be in place on each site. The password policy and user naming
conventions will come from the root domain. Only the right people will be
made administrator of the domain.

I need to gather the right arguments to choose either for OUs or Child Trees
before implementing Active Directory in the different sites.

Regards

Paul Bergson · Guest

It seems it has already been made though if you require a separate name
space. Am I wrong on this?

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

Archibald · Guest

Yes, a separate DNS name space will be required for each site.

Paul Bergson · Guest

Then you need a separate domain. I guess you could use Domain and Trusts
and alias a domain but I wouldn't recommend that.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

Paul Bergson · Guest

Yes, you can link gpo's to other domains in the same forest.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA
This posting is provided "AS IS" with no warranties, and confers no rights.

millin · Guest

Hi paul ,
If you need a seperate domain for each site,then how can you control
password policy and user naming convention from a single domain(i.e;root
domain)
thaks in advance.
mill

SIME U via WinServerKB.co · Guest

Hi

In order to have the same password policy can you not link the same GPO to
the root and child domains? - not sure I have never tried it

Simon

Spin · Guest

Oh really? You can link GPOs across domains in a forest? I would be really
interested in a Microsoft KB which says how to do that.

--
Spin

Paul Bergson · Guest

I know I have had this in an MCSE test, but I can't find a single thing in
the KB. Have I gone crazy? Maybe. Post this question in the gpo newsgroup
if there is a specific need.

I'll keep looking and post if I can find something.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

	Windows Server Forum Index -> Active Directory	All times are GMT
Page 1 of 1