Home / server / Questions / 784870
Accepted
Michael Brown
Asked: 2016-06-20 03:40:06 +0800 CST

why use an Active Directory multi-tree design?

  • 772

I get asked the same question a lot. Why use multi-tree forests when designing Active Directory?

I know that the two trees will belong to different namespaces and that they will share Scheme/configuration partition/Forest FSMO roles etc.

why not use two forests with a Forest trust instead?

I would be keen to get real world examples of multi-tree designs being used today and why people are using them.

Thanks in advance.

active-directory windows-server-2012-r2 windows-server-2012

1 Answers

  1. Best Answer

    The only reason to have a disjointed namespace is because you do not have control over the other DNS namespace OR have a need to separate control of the other namespace, while maintaining control over the AD objects on both. The issue wih disjoint namespaces is that most (if not all AD aware apps) use the assumption that the UPN suffix will be the same for all users.

    • 1