Under what conditions should Administrators create multiple forests?

Under what conditions should Administrators create multiple forests?

Rating:

Microsoft recommends the creation of multiple forests under the following conditions:

• If Administrators do not trust each other: An Administrator can create a "denial of service" condition. One can create this condition by rapidly creating or deleting objects, hence causing a large amount of replication to the global catalog. This replication can waste network bandwidth and slow down global catalog servers, as they spend time in processing replication. This condition forces administrators to create multiple forests.


• Organizations cannot agree on a forest change policy: Changes in schema, configuration, and the addition of new domains to a forest have forest-wide impact. If organizations in a forest cannot agree on a common policy, they cannot share the same forest, forcing administrators to create multiple forests.


• If one wants to limit the scope of a trust relationship: All domains in a forest trust each other. In order to prevent certain users from being granted permissions to certain resources, those users must be placed in a forest different from the forest containing those resources. Administrators can use explicit trust relationships to allow those users to be granted access to resources in specific domains, if required.

Rating: