---
description: Idea of AD Forests ?
---

# AD Forests

## What is Active Directory Forests&#x20;

> <mark style="background-color:blue;">**An Active Directory Forest**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">is the highest-level logical container in Active Directory, consisting of one or more domain trees that share a common schema, configuration, and global catalog, but may have different "DNS" namespaces. A forest defines the ultimate security and administrative boundary in an AD environment(</mark><mark style="color:blue;">**Objects in one forest cannot natively access resources in another forest unless an explicit trust is created.**</mark><mark style="background-color:blue;">), enabling centralized management, resource sharing, and cross-domain collaboration across its domains and trees while maintaining a unified framework</mark>

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FxbVAJpWhy2gljLnU5Rh1%2Fdomain-forest%402x.png?alt=media&#x26;token=761f794b-1821-42b3-853d-1551eb822b94" alt=""><figcaption><p>Idea of the Forests </p></figcaption></figure>

## <mark style="background-color:blue;">Key characteristics of an AD forest</mark>

1. <mark style="color:blue;">**Collection of Domain Trees**</mark>: A forest contains one or more [domain tree](domain-trees)[s](domain-trees), each with its own contiguous namespace (_<mark style="color:blue;">`example.com`</mark>_ and _<mark style="color:blue;">**`anothercorp.com`**</mark>_).
2. <mark style="color:blue;">**Common Schema**</mark>: All domains in the forest share a single schema, defining object types and attributes.
3. <mark style="color:blue;">**Global Catalog**</mark>: A forest-wide database that stores a partial replica of objects from all domains, facilitating cross-domain searches and authentication.
4. <mark style="color:blue;">**Transitive Trusts**</mark>: Automatic, two-way, transitive trusts connect all domains within the forest, enabling seamless resource access.
5. <mark style="color:blue;">**Security Boundary**</mark>: The forest is the ultimate security boundary; objects, policies, and permissions are confined within it unless explicitly shared via external trusts.
6. <mark style="color:blue;">**Administrative Scope**</mark>: The forest provides overarching administrative control, with Enterprise Admins having forest-wide authority.



## Components of Active Directory Forests

> _<mark style="background-color:blue;">To understand forests, let’s deep Dive into key components and related elements:</mark>_

1. <mark style="background-color:blue;">**Domain Trees**</mark>
   * <mark style="color:blue;">**Definition**</mark>: A hierarchical collection of domains sharing a contiguous DNS namespace ( _<mark style="color:blue;">`example.com`</mark><mark style="color:blue;">,</mark> <mark style="color:blue;"></mark><mark style="color:blue;">`sales.example.com`</mark>_).
   * <mark style="color:blue;">**Role**</mark>: Domain trees organize domains within the forest, with each tree having its own root domain and namespace.
   * <mark style="color:blue;">**Example**</mark>: The example.com tree includes _<mark style="color:blue;">`example.com`</mark>_ and _<mark style="color:blue;">`sales.example.com`</mark>_.\

2.  <mark style="background-color:blue;">**Domains**</mark>

    * <mark style="color:blue;">**Definition**</mark>: Logical groupings of objects (users, computers, groups, OUs) with a common AD database and security policies.
    * <mark style="color:blue;">**Role**</mark>: Domains are the building blocks of domain trees and forests, each with its own domain controllers and administrative scope.
    * <mark style="color:blue;">**Example**</mark>: _<mark style="color:blue;">`example.com`</mark>_, _<mark style="color:blue;">`sales.example.com`</mark>_, _<mark style="color:blue;">`anothercorp.com`</mark>_.


3. <mark style="background-color:blue;">**Forest Root Domain**</mark>
   * <mark style="color:blue;">**Definition**</mark>: The first ever domain created in the forest, which serves as the root of the first domain tree and holds special forest-wide roles.
   * <mark style="color:blue;">**Role**</mark>: Hosts critical Flexible Single Master Operation (FSMO) roles (Schema Master, Domain Naming Master) and is managed by Enterprise Admins.
   * <mark style="color:blue;">**Example**</mark>: _<mark style="color:blue;">`example.com`</mark>_ as the forest root domain in a forest with trees _<mark style="color:blue;">`example.com`</mark>_ and _<mark style="color:blue;">`anothercorp.com`</mark>_.



4. <mark style="background-color:blue;">**Schema**</mark>
   * <mark style="color:blue;">**Definition**</mark>: A forest-wide set of rules defining the types of objects (users, groups) and their attributes (email, name) in AD.
   * <mark style="color:blue;">**Role**</mark>: Ensures consistency across all domains in the forest.
   * <mark style="color:blue;">**Management**</mark>: Schema updates are controlled by the Schema Master role, typically in the forest root domain.
   * <mark style="color:blue;">**Example**</mark>: The schema defines that a user object can have a userPrincipalName attribute.



5. <mark style="background-color:blue;">**Global Catalog**</mark>
   * <mark style="color:blue;">**Definition**</mark>: A distributed database that stores a partial replica of attributes for all objects in every domain in the forest.
   * <mark style="color:blue;">**Role**</mark>: Enables cross-domain searches (finding a user in another domain) and authentication (resolving group memberships).
   * <mark style="color:blue;">**Global Catalog Servers**</mark>: Domain controllers designated to host the global catalog.
   * <mark style="color:blue;">**Example**</mark>: A user in _<mark style="color:blue;">`sales.example.com`</mark>_ queries the global catalog to locate a printer in _<mark style="color:blue;">`anothercorp.com`</mark>_.



6. <mark style="background-color:blue;">**Trust Relationships**</mark>
   * <mark style="color:blue;">**Definition**</mark>: Automatic, two-way, transitive trusts that connect all domains within the forest.
   * <mark style="color:blue;">**Types**</mark>:
     * <mark style="color:blue;">**Parent-Child Trusts**</mark>: Connect domains within a tree (_<mark style="color:blue;">`example.com`</mark>_ ↔ _<mark style="color:blue;">`sales.example.com`</mark>_).
     * <mark style="color:blue;">**Tree-Root Trusts**</mark>: Connect root domains of different trees (_<mark style="color:blue;">`example.com`</mark>_ ↔ _<mark style="color:blue;">`anothercorp.com`</mark>_).
     * <mark style="color:blue;">**Cross-Forest Trusts**</mark>: Explicit trusts with other forests (not automatic).
   * <mark style="color:blue;">**Purpose**</mark>: Enable authentication and resource access across domains using Kerberos.
   * <mark style="color:blue;">**Example**</mark>: A user in _<mark style="color:blue;">`sales.example.com`</mark>_ accesses a resource in _<mark style="color:blue;">`hr.anothercorp.com`</mark>_ via transitive trusts.



7. <mark style="background-color:blue;">**Domain Controllers**</mark>
   * <mark style="color:blue;">**Definition**</mark>: Servers hosting the AD database for a specific domain in the forest.
   * <mark style="color:blue;">**Role**</mark>: Manage authentication, replication, and object storage for their domain, with some hosting the global catalog.
   * <mark style="color:blue;">**Example**</mark>: _<mark style="color:blue;">`dc1.example.com`</mark>_ for _<mark style="color:blue;">`example.com`</mark>_, _<mark style="color:blue;">`dc1.sales.example.com`</mark>_ for _<mark style="color:blue;">`sales.example.com`</mark>_.



8. <mark style="background-color:blue;">**Groups and OUs**</mark>
   * <mark style="color:blue;">**Groups**</mark>: Manage permissions and policy application across domains in the forest (universal groups like U\_AllEmployees).
   * <mark style="color:blue;">**OUs**</mark>: Organize objects within each domain, not replicated forest-wide but accessible via trusts and the global catalog.



## Logical Structure of Active Directory Forests

> <mark style="background-color:blue;">The logical structure of an AD forest is a collection of domain trees, unified by a shared schema, configuration, and global catalog, with transitive trusts connecting all domains, independent of physical network topology.</mark>

1. <mark style="background-color:blue;">**Collection of Domain Trees**</mark>
   * <mark style="color:blue;">**Structure**</mark>: A forest contains one or more domain trees, each with its own contiguous namespace.
   * <mark style="color:blue;">Namespace</mark>: Each tree has a unique namespace (_<mark style="color:blue;">`example.com`</mark>_, _<mark style="color:blue;">`anothercorp.com`</mark>_), unlike a domain tree’s single namespace.
   * <mark style="color:blue;">**Example**</mark>:

```
Forest
├── Tree 1: example.com
│ ├── example.com (Root Domain)
│ ├── sales.example.com (Child Domain)
│ └── marketing.example.com (Child Domain)
└── Tree 2: anothercorp.com
├── anothercorp.com (Root Domain)
└── hr.anothercorp.com (Child Domain)

```



2. <mark style="color:blue;">**Trust Relationships**</mark>
   * <mark style="color:blue;">**Intra-Tree Trusts**</mark>: Parent-child trusts connect domains within a tree (_<mark style="color:blue;">`example.com`</mark>_ ↔ _<mark style="color:blue;">`sales.example.com`</mark>_).
   * <mark style="color:blue;">**Inter-Tree Trusts**</mark>: Tree-root trusts connect root domains of different trees (_<mark style="color:blue;">`example.com`</mark>_ ↔ _<mark style="color:blue;">`anothercorp.com`</mark>_).
   * <mark style="color:blue;">**Transitivity**</mark>: All domains in the forest are implicitly trusted via transitive trusts.
   * <mark style="color:blue;">**Example**</mark>: A user in sales.example.com accesses a resource in _<mark style="color:blue;">`hr.anothercorp.com`</mark>_ through the trust path: _<mark style="color:blue;">`sales.example.com`</mark>_ → _<mark style="color:blue;">`example.com`</mark>_ → _<mark style="color:blue;">`anothercorp.com`</mark>_ → _<mark style="color:blue;">`hr.anothercorp.com`</mark>_.



3. <mark style="background-color:blue;">**Global Catalog**</mark>
   * <mark style="color:blue;">**Contents**</mark>: Partial attributes of all objects (user names, group memberships) from every domain and also their context Within the Forest .
   * <mark style="color:blue;">**Purpose**</mark>: Enables forest-wide searches and cross-domain authentication.
   * <mark style="color:blue;">**Example**</mark>: A user in example.com queries the global catalog to find a group in _<mark style="color:blue;">`anothercorp.com.`</mark>_



4. <mark style="background-color:blue;">**Administrative Hierarchy**</mark>
   * <mark style="color:blue;">**Forest-Wide Admins**</mark><mark style="color:blue;">:</mark> Enterprise Admins (in the forest root domain) have authority over the entire forest.
   * <mark style="color:blue;">**Domain Admins**</mark>: Manage specific domains within the forest.
   * <mark style="color:blue;">**Delegated Admins**</mark>: Manage OUs or groups within domains.
   * <mark style="color:blue;">**Example**</mark>: Enterprise Admins in _<mark style="color:blue;">`example.com`</mark>_ can add a new domain, while Domain Admins in _<mark style="color:blue;">`sales.example.com`</mark>_ manage only their domain.



## Forests in the Context of Active Directory

> <mark style="background-color:blue;">Forests are the top-level structure in AD, encompassing domains, domain trees, OUs, and groups, providing a unified framework for management and security.</mark>

1. <mark style="background-color:blue;">**Role of Forests**</mark>
   * <mark style="color:blue;">**Security Boundary**</mark><mark style="color:blue;">:</mark> The forest is the ultimate boundary for security policies, schema, and object access.
   * <mark style="color:blue;">**Administrative Boundary**</mark><mark style="color:blue;">:</mark> Defines the scope of Enterprise Admins and forest-wide roles.
   * <mark style="color:blue;">**Unification**</mark><mark style="color:blue;">:</mark> Combines multiple domain trees with different namespaces into a single management structure.
   * <mark style="color:blue;">**Example**</mark><mark style="color:blue;">:</mark> A forest unifies _<mark style="color:blue;">`example.com`</mark>_ and _<mark style="color:blue;">`anothercorp.com`</mark>_ trees for resource sharing.



2. <mark style="background-color:blue;">**Logical Structure of Forests**</mark>
   * <mark style="color:blue;">**Hierarchy**</mark>: Forests contain domain trees, which contain domains, which contain OUs and groups.
   * <mark style="color:blue;">**Trusts**</mark>: Transitive trusts connect all domains, enabling forest-wide collaboration.
   * <mark style="color:blue;">**Shared Resources**</mark>:
     * <mark style="color:blue;">**Schema**</mark>: Ensures consistent object definitions.
     * <mark style="color:blue;">**Global Catalog**</mark>: Facilitates cross-domain operations.
     * <mark style="color:blue;">**Configuration**</mark>: Standardizes forest-wide settings.
   * <mark style="color:blue;">**Example:**</mark>

```
Forest
├── Tree 1: example.com
│   ├── example.com
│   │   ├── Sales (OU)
│   │   │   ├── Users (OU, User: john.doe)
│   │   │   └── Groups (OU, Group: G_SalesUsers)
│   │   └── Resources (OU, Group: DL_FileAccess)
│   └── sales.example.com
│       ├── Marketing (OU)
│       └── Groups (OU, Group: G_MarketingUsers)
└── Tree 2: anothercorp.com
    ├── anothercorp.com
    │   ├── Finance (OU)
    │   └── Groups (OU, Group: U_AllEmployees)
    └── hr.anothercorp.com
```



3. <mark style="background-color:blue;">**How Forests Interact with Other AD Components**</mark>
   * <mark style="color:blue;">**Domains**</mark>: Forests group domains into trees, with each domain maintaining its own database and policies.
   * <mark style="color:blue;">**Domain Trees**</mark>: Forests contain one or more trees, each with a unique namespace, connected by tree-root trusts.
   * <mark style="color:blue;">**OUs**</mark>: Exist within domains, organizing objects, but accessible forest-wide via the global catalog and trusts.
   * <mark style="color:blue;">**Groups**</mark>: Manage permissions and policies, with universal groups enabling forest-wide access.
   * <mark style="color:blue;">**Resource Access**</mark>:
     * A user in _<mark style="color:blue;">`sales.example.com`</mark>_ accesses a resource in _<mark style="color:blue;">`hr.anothercorp.com`</mark>_ via transitive trusts.
     * Example: G\_SalesUsers (in _<mark style="color:blue;">`sales.example.com`</mark>_) is nested in DL\_FileAccess (in _<mark style="color:blue;">`example.com`</mark>_) for file server access.
   * <mark style="color:blue;">**Authentication**</mark>:
     * Kerberos uses trust paths to authenticate users across domains in the forest.
     * The global catalog resolves universal group memberships.
   * <mark style="color:blue;">**Administration**</mark>:
     * Enterprise Admins manage forest-wide tasks ( schema updates).
     * Domain Admins manage individual domains.
     * Delegated admins manage OUs or groups.



## **Functionality of Active Directory Forests**

> <mark style="background-color:blue;">Forests serve critical functions in AD:</mark>

1. &#x20;<mark style="background-color:blue;">**Unified Management**</mark>

* <mark style="color:blue;">**Purpose**</mark>: Provide a single framework for managing multiple domains and trees.
* <mark style="color:blue;">**Example**</mark>: A single schema ensures consistent user attributes across _<mark style="color:blue;">`example.com`</mark>_ and _<mark style="color:blue;">`anothercorp.com`</mark>_.

2. &#x20;<mark style="background-color:blue;">**Resource Sharing**</mark>

* <mark style="color:blue;">**Purpose**</mark>: Transitive trusts and the global catalog enable cross-domain resource access.
* <mark style="color:blue;">**Example**</mark>: A user in _<mark style="color:blue;">`sales.example.com`</mark>_ accesses a printer in _<mark style="color:blue;">`hr.anothercorp.com`</mark>_.

3. <mark style="background-color:blue;">**Security Boundary**</mark>

* <mark style="color:blue;">**Purpose**</mark>: Confine security policies and objects within the forest, protecting against external access.
* <mark style="color:blue;">**Example**</mark>: A compromised account in _<mark style="color:blue;">`example.com`</mark>_ cannot affect another forest without an explicit trust.

4. <mark style="background-color:blue;">**Cross-Domain Collaboration**</mark>
   * <mark style="color:blue;">**Purpose**</mark>: Enable authentication and resource access across domains using trusts.
   * <mark style="color:blue;">**Example**</mark>: A universal group U\_AllEmployees grants forest-wide application access.
5. <mark style="background-color:blue;">**Centralized Administration**</mark>
   * <mark style="color:blue;">**Purpose**</mark>: Allow forest-wide tasks (schema updates) to be managed by Enterprise Admins.
   * <mark style="color:blue;">**Example**</mark>: Adding a new domain tree to the forest is controlled by the Domain Naming Master(_<mark style="background-color:blue;">**Flexible Single Master Operations (FSMO)**</mark>_ ).



## **Real-World Example**

> <mark style="background-color:blue;">Consider</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**GlobalTech**</mark><mark style="background-color:blue;">, a multinational corporation with a forest integrating multiple domain trees:</mark>

* **Forest Structure**:

```
Forest
├── Tree 1: globaltech.com
│   ├── globaltech.com (Forest Root Domain)
│   │   ├── Resources (OU)
│   │   │   └── Groups (OU, Group: DL_FileAccess)
│   │   └── IT (OU, Group: G_ITAdmins)
│   ├── na.globaltech.com (Child Domain)
│   │   ├── Sales (OU)
│   │   │   ├── Users (OU, User: john.doe)
│   │   │   └── Groups (OU, Group: G_SalesUsers)
│   │   └── Marketing (OU)
│   └── eu.globaltech.com (Child Domain)
│       └── uk.eu.globaltech.com (Grandchild Domain, User: alice.smith)
└── Tree 2: acquiredcorp.com
    ├── acquiredcorp.com (Root Domain)
    │   ├── Finance (OU, Group: G_FinanceTeam)
    │   └── Groups (OU, Group: U_AllEmployees)
    └── hr.acquiredcorp.com (Child Domain)
```

* <mark style="background-color:blue;">**Components**</mark>:
  * <mark style="color:blue;">**Forest Root Domain**</mark><mark style="color:blue;">:</mark> _<mark style="color:blue;">`globaltech.com`</mark>_, hosting Schema Master and Domain Naming Master.
  * <mark style="color:blue;">**Domain Trees**</mark><mark style="color:blue;">:</mark> _<mark style="color:blue;">`globaltech.com`</mark>_ (with child domains _<mark style="color:blue;">`na.globaltech.com`</mark>_, _<mark style="color:blue;">`eu.globaltech.com`</mark>_) and _<mark style="color:blue;">`acquiredcorp.com`</mark>_.
  * <mark style="color:blue;">**Trusts**</mark><mark style="color:blue;">:</mark>
    * Parent-child: _<mark style="color:blue;">`globaltech.com`</mark>_ ↔_<mark style="color:blue;">`na.globaltech.com`</mark>_, _<mark style="color:blue;">`eu.globaltech.com`</mark>_ ↔ _<mark style="color:blue;">`uk.eu.globaltech.com`</mark>_.
    * Tree-root: _<mark style="color:blue;">`globaltech.com`</mark>_ ↔ _<mark style="color:blue;">`acquiredcorp.com.`</mark>_
    * Transitive: _<mark style="color:blue;">`na.globaltech.com`</mark>_ ↔ _<mark style="color:blue;">`hr.acquiredcorp.com`</mark>_.
  * <mark style="color:blue;">**Groups**</mark><mark style="color:blue;">:</mark>
    * U\_AllEmployees (universal, in _<mark style="color:blue;">`acquiredcorp.com`</mark>_): Includes G\_SalesUsers and G\_FinanceTeam.
    * DL\_FileAccess (domain-local, in _<mark style="color:blue;">`globaltech.com`</mark>_): Grants access to _<mark style="color:blue;">`\\fileserver.globaltech.com\Shared`</mark>_, includes G\_SalesUsers.
  * <mark style="color:blue;">**Global Catalog**</mark>: Stores partial data from all domains, enabling searches for john.doe or U\_AllEmployees.
* <mark style="color:blue;">**Functionality**</mark><mark style="color:blue;">:</mark>
  * **Access**: john.doe (in _<mark style="color:blue;">`na.globaltech.com`</mark>_) accesses a file server in _<mark style="color:blue;">`globaltech.com`</mark>_ via G\_SalesUsers membership in DL\_FileAccess.
  * **Authentication**: alice.smith (in _<mark style="color:blue;">`uk.eu.globaltech.com`</mark>_) authenticates to access a resource in _<mark style="color:blue;">`hr.acquiredcorp.com`</mark>_ using transitive trusts.
  * **Administration**: Enterprise Admins in _<mark style="color:blue;">`globaltech.com`</mark>_ add a new domain, while Domain Admins in na.globaltech.com manage Sales users.
  * **Search**: A user queries the global catalog to find G\_FinanceTeam in acquiredcorp.com.

***

