---
description: Idea of AD Domains ?
---

# Domain Trees

## <mark style="background-color:blue;">What is Domain Trees</mark>

> <mark style="color:blue;">**A Domain Tree in Active Directory (AD)**</mark> is a hierarchical collection of domains that share a **contiguous DNS namespace** and are linked through **automatic two-way transitive trusts**. It allows organizations to scale their directory services while maintaining logical structure and security boundaries.

* A **Domain Tree** consists of:
  * A **root domain** (e.g., `example.com`).
  * One or more **child domains** (e.g., `us.example.com`, `eu.example.com`).\

* All domains in a tree share:
  * A **common schema** (object definitions).
  * A **common configuration partition** (replication settings).
  * A **common Global Catalog** (searchable directory of all objects).\


## <mark style="background-color:blue;">**Key Characteristics of Domain Trees**</mark>

* <mark style="color:blue;">**Contiguous Namespace**</mark>: All domains in the tree share a common DNS root name (`example.com`, `sales.example.com`, `europe.sales.example.com`).
* <mark style="color:blue;">**Parent-Child Relationships**</mark>: Domains are arranged hierarchically, with a **root domain** at the top and **child domains** beneath it.
* <mark style="color:blue;">**Trust Relationships**</mark>: Automatic, transitive, two-way trusts link parent and child domains, enabling resource sharing and authentication across the tree.
* <mark style="color:blue;">**Forest Membership**</mark>: A domain tree is part of an AD forest, which may contain multiple domain trees with different namespaces.
* <mark style="color:blue;">**Logical Structure**</mark>: Domain trees are a logical organization, independent of the physical network topology, used to manage resources and security.
* <mark style="color:blue;">**DNS Dependency**</mark>: The tree relies on DNS for name resolution, with each domain corresponding to a DNS domain.

## <mark style="background-color:blue;">Components of Domain Trees</mark>

> _<mark style="background-color:blue;">**To understand domain trees, let’s deep dive into their key components and related elements:**</mark>_

1. <mark style="background-color:blue;">**Domain**</mark>

* <mark style="color:blue;">**Definition**</mark>: A domain is a logical grouping of network objects (users, computers, groups, OUs) that share a common security database and policies, managed by domain controllers.
* <mark style="color:blue;">**Role in Tree**</mark>: Domains are the building blocks of a domain tree, arranged in a parent-child hierarchy.
* <mark style="color:blue;">**Example**</mark>: `example.com` (<mark style="color:blue;">**root domain**</mark>), `sales.example.com` (<mark style="color:blue;">**child domain**</mark>).\


2. <mark style="background-color:blue;">**Root Domain**</mark>

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FuSQLP4882swxVFKFVNNa%2FRoot-node.avif?alt=media&#x26;token=e3c5dd6d-4027-4a4e-8599-5e88ba7d5c1f" alt=""><figcaption><p>Idea of Root Node</p></figcaption></figure>

* <mark style="color:blue;">**Definition**</mark>: The top-level(<mark style="color:blue;">**Tree is divided into levels 0,1,2....**</mark> ) domain(<mark style="color:blue;">Root node of the Tree</mark>) in the tree, serving as the starting point for the [namespace ](idea-of-ad-namespaces)and hierarchy.
* <mark style="color:blue;">**Role**</mark>: The root domain (`example.com`) is the parent of all child domains in the Domain Tree.
* <mark style="color:blue;">**Example**</mark>: `example.com` is the root domain of a tree containing `sales.example.com` and `marketing.example.com`.



3. <mark style="color:blue;">**Child Domain**</mark>

<div data-full-width="true"><figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FIHvlGHzOfCJobf9mjJFh%2Fimage.png?alt=media&#x26;token=d1e6b7df-e1d3-4f36-8ca5-53470a33975e" alt="" width="563"><figcaption><p>Idea of Child Domains </p></figcaption></figure></div>

* <mark style="color:blue;">**Definition**</mark>: A domain directly Driven/subordinate from/to the root domain or another child domain, _**inheriting part of its DNS name from its parent**_<mark style="background-color:blue;">**.**</mark>
* <mark style="color:blue;">**Role**</mark>: Child domains (`sales.example.com`, `europe.sales.example.com`) useful for **l**<mark style="background-color:blue;">**arge organizations needing separate administrative control, security policies, or geographical divisions while maintaining a centralized forest structure.**</mark>
* <mark style="color:blue;">**Example**</mark>: `europe.sales.example.com` is a child of `sales.example.com`, which is a child of `example.com`.



3. <mark style="background-color:blue;">**Contiguous Namespace**</mark>
   * <mark style="color:blue;">**Definition**</mark>: A shared DNS naming structure where each domain’s name is a subdomain of its parent, forming a continuous hierarchy.
   * <mark style="color:blue;">**Example**</mark>:
     * `example.com` (root)
     * `sales.example.com` (child)
     * `europe.sales.example.com` (grandchild)
   * <mark style="color:blue;">**Purpose**</mark>: Ensures a consistent, globally unique naming convention, aligned with DNS standards.



4. <mark style="background-color:blue;">**Domain Controllers**</mark>
   * <mark style="color:blue;">**Definition**</mark>: Servers that host the AD database and AD service that manage LDAP-LookUps for Data in the database for a domain and provide authentication and directory services.
   * <mark style="color:blue;">**Role in Tree**</mark>: Each domain in the tree has its own domain controllers, which replicate the domain’s database within the domain but not across domains.
   * <mark style="color:blue;">**Example**</mark>: `dc1.example.com` for `example.com`, `dc1.sales.example.com` for `sales.example.com`.



5. <mark style="background-color:blue;">**DNS**</mark>
   * <mark style="color:blue;">**Definition**</mark>: The Domain Name System resolves domain names to IP addresses, critical for locating domain controllers and resources in the tree.
   * <mark style="color:blue;">**Role**</mark>: Each domain in the tree corresponds to a DNS domain, with DNS servers storing records    ([**SRV records**](dns-service-records)) to support AD operations.
   * <mark style="color:blue;">**Example**</mark>: DNS resolves **`sales.example.com`** to its domain controllers’ IP addresses.



6. <mark style="background-color:blue;">**Schema**</mark>
   * <mark style="color:blue;">**Definition**</mark>: The schema defines the types of objects and attributes that can exist in the tree’s domains.
   * <mark style="color:blue;">**Scope**</mark>: Shared across all domains in the forest, ensuring consistency.
   * <mark style="color:blue;">**Example**</mark>: The schema allows user objects to have attributes like _`email or telephoneNumber`_.\

7. <mark style="background-color:blue;">**Global Catalog**</mark>
   * <mark style="color:blue;">**Definition**</mark>: A forest-wide database that stores a partial replica of objects from all domains in the forest, including those in the tree , the Basic idea is that is responsible for detection of Resource Context Within The Forest for allocating them in easier way.
   * <mark style="color:blue;">**Role**</mark>: Facilitates cross-domain searches and authentication within the tree and forest.
   * <mark style="color:blue;">**Example**</mark>: A user in _`sales.example.com`_ can search for a resource in _`example.com`_ via the global catalog.

## Functionality of Domain Trees

> <mark style="background-color:blue;">Domain trees serve several critical functions within Active Directory:</mark>

1.  <mark style="background-color:blue;">**Hierarchical Organization**</mark>

    * <mark style="color:blue;">**Purpose**</mark>: Organizes domains into a logical hierarchy based on DNS names, reflecting organizational or geographic structures.
    * <mark style="color:blue;">**Example**</mark>: _<mark style="color:blue;">`europe.sales.example.com`</mark>_ for the European Sales division under _<mark style="color:blue;">`sales.example.com`</mark>_.

    \

2. <mark style="background-color:blue;">**Resource Sharing**</mark>
   * <mark style="color:blue;">**Purpose**</mark>: Transitive trusts enable users in one domain to access resources in another within the tree.
   * <mark style="color:blue;">**Example**</mark>: A user in _**`asia.sales.example.com`**_ accesses a shared folder in _**`example.com`**_.\

3. <mark style="background-color:blue;">Decentralized Administration</mark>&#x20;

> <mark style="background-color:blue;">Decentralized administration is a design principle in AD where administrative tasks are distributed to specific domains or organizational units (OUs) to reduce the workload on central IT and allow localized management. Each domain in AD, including child domains, acts as a</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**security boundary**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">with its own namespace and administrative scope. This means:</mark>
>
> * <mark style="color:blue;">**Child Domain Autonomy**</mark>: <mark style="background-color:blue;">Local administrators in the child domain (</mark>`sales.example.com`<mark style="background-color:blue;">) are granted permissions to manage resources within their domain, such as creating user accounts, resetting passwords, or applying group policies. These tasks are handled without requiring intervention from the parent domain (</mark>`example.com`<mark style="background-color:blue;">).</mark>
> * <mark style="color:blue;">**Limited Parent Domain Control**</mark>: <mark style="background-color:blue;">By default, administrators in the parent domain do not manage the child domain’s resources directly. For example, a parent domain admin cannot create a user account in sales.example.com unless explicitly granted permissions to do so.</mark>
> * <mark style="color:blue;">**Forest-Wide Authority**</mark>: <mark style="background-color:blue;">The parent domain, especially if it is the forest root domain, hosts critical components like the</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**schema**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">and</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**global catalog**</mark><mark style="background-color:blue;">, which apply to all domains in the forest. Forest-level administrators (e.g., members of the</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**Enterprise Admins**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">group) have the authority to make changes that affect all domains, including child domains.</mark>
>   * <mark style="background-color:blue;">**Example**</mark>: <mark style="color:blue;">An Enterprise Admin in example.com could modify the AD schema, impacting sales.example.com.</mark>



4. <mark style="background-color:blue;">**Scalability**</mark>

> <mark style="background-color:blue;">AD achieves scalability through its hierarchical structure, particularly by using domain trees, which distribute the AD database across multiple domains. This distribution allows large organizations to manage complex environments efficiently by segmenting resources and administrative responsibilities.</mark>
>
> <mark style="background-color:blue;">Each domain in AD maintains its own portion of the AD database, which includes objects specific to that domain. By organizing domains into a tree structure, AD can scale to support thousands or even millions of objects across global networks, as seen in large enterprises or multinational corporations</mark>

* <mark style="color:blue;">**Database Segmentation:**</mark> Each domain in the tree maintains its own AD database partition, storing only the objects relevant to that domain. This reduces the size of the database that each domain controller must manage, improving performance.



5. <mark style="background-color:blue;">**Security Segmentation**</mark>
   * <mark style="color:blue;">**Purpose**</mark>: Domains act as security boundaries, allowing different policies for each domain.
   * <mark style="color:blue;">**Example**</mark>: `research.example.com` has stricter security policies than `marketing.example.com`.

## <mark style="background-color:blue;">**How Domain Trees Work**</mark>

#### <mark style="color:blue;">**A. DNS Hierarchy & Naming**</mark>

* **Root Domain**: `example.com`
* **Child Domains**: `us.example.com`, `eu.example.com`
* **Subdomains**: `sales.us.example.com`, `hr.eu.example.com`

#### <mark style="color:blue;">**B. Trust Relationships**</mark>

* **Parent-Child Trusts**: Automatically created when a child domain is added.
* **Transitive Trusts**: Extend trust across the entire tree (e.g., `example.com` ↔ `sales.us.example.com`).

#### <mark style="color:blue;">**C. Authentication & Authorization**</mark>

* **Kerberos Authentication**: Works across domains via trust relationships.
* **Global Catalog (GC)**: Enables cross-domain searches (e.g., finding a user in `hr.eu.example.com` from `us.example.com`).



## <mark style="background-color:blue;">Domain Trees in the Context of Active Directory Forests</mark>

> <mark style="background-color:blue;">**Domain trees are a mid-level structure within the AD hierarchy, fitting between domains (the smallest unit) and forests (the largest unit). Let’s explore their role and interaction within a forest.**</mark>

1. <mark style="background-color:blue;">**Role of Domain Trees in a Forest**</mark>
   * <mark style="color:blue;">**Organization**</mark>: Domain trees group domains with a contiguous namespace, providing a logical structure within the forest.
   * <mark style="color:blue;">**Scalability**</mark>: Trees allow organizations to segment domains for administrative or geographic purposes while maintaining forest-wide integration.
   * <mark style="color:blue;">**Trust Framework**</mark>: Trees leverage forest-wide trusts to enable resource sharing across domains.\

2. <mark style="background-color:blue;">**Logical Structure of Domain Trees in a Forest**</mark>
   * <mark style="color:blue;">**Tree-Level Hierarchy**</mark>: Within a tree, domains form a parent-child structure with a contiguous namespace.
   * <mark style="color:blue;">**Forest-Level Integration**</mark>:
     * Each tree has its own namespace, but all trees share the forest’s schema, configuration, and global catalog.
     * **Tree-Root Trusts**: The root domains of different trees (`example.com` and `anothercorp.com`) have automatic, two-way, transitive trusts, linking all domains in the forest.
   * <mark style="color:blue;">**Global Catalog**</mark>: Stores partial attributes of objects from all domains in the tree, enabling cross-tree searches.
   * <mark style="color:blue;">**Schema and Configuration**</mark>: Shared across all domains in the tree and forest, ensuring consistency.
3. <mark style="background-color:blue;">**How Domain Trees Interact in a Forest**</mark>
   * <mark style="color:blue;">**Resource Sharing**</mark><mark style="color:blue;">:</mark>
     * Transitive trusts within the tree and across the forest allow users in one domain to access resources in another.
     * <mark style="color:blue;">**Example**</mark>: A user in sales.example.com accesses a file server in `hr.anothercorp.com` via trusts and group memberships (`DL_FileAccess`).
   * <mark style="color:blue;">**Authentication**</mark><mark style="color:blue;">:</mark>
     * Kerberos authentication leverages trust paths to authenticate users across domains in the tree and forest.
     * <mark style="color:blue;">**Example**</mark>: A user in `europe.sales.example.com` authenticates to a resource in `example.com` using the parent-child trust.
   * <mark style="color:blue;">**Administration**</mark><mark style="color:blue;">:</mark>
     * Each domain in the tree has its own administrators, but Enterprise Admins in the forest root domain oversee the entire forest.
     * <mark style="color:blue;">**Example**</mark>: Domain Admins in sales.example.com manage their domain, while Enterprise Admins in example.com can modify the tree or forest.



## <mark style="background-color:blue;">**Example: Enterprise Domain Tree Structure**</mark>

```
Forest
├── Tree 1: globalcorp.com
│   ├── globalcorp.com (Root Domain)
│   ├── na.globalcorp.com (Child Domain)
│   │   ├── Sales (OU)
│   │   │   ├── Users (OU, User: john.doe)
│   │   │   └── Groups (OU, Group: G_SalesUsers)
│   │   └── IT (OU)
│   ├── eu.globalcorp.com (Child Domain)
│   │   └── uk.eu.globalcorp.com (Grandchild Domain)
│   └── marketing.globalcorp.com (Child Domain)
└── Tree 2: acquiredcorp.com
    ├── acquiredcorp.com (Root Domain)
    └── hr.acquiredcorp.com (Child Domain)
```

* <mark style="background-color:blue;">**Domain Tree Example**</mark><mark style="background-color:blue;">: globalcorp.com Tree</mark>
  * <mark style="background-color:blue;">**Root Domain**</mark>: _<mark style="color:blue;">`globalcorp.com`</mark>_
    * Hosts central resources (file servers) and forest-wide roles.
    * OU: Resources, Group: _<mark style="color:blue;">`DL_FileAccess`</mark>_ (domain-local, grants access to  _<mark style="color:blue;">`\\fileserver.globalcorp.com\Shared`</mark>_).
  * <mark style="background-color:blue;">**Child Domain**</mark>: _<mark style="color:blue;">`na.globalcorp.com`</mark>_
    * Manages North American users and resources.
    * OU: Sales\Groups, Group: G\_SalesUsers (global, includes john.doe).
  * <mark style="background-color:blue;">**Grandchild Domain**</mark>: _<mark style="color:blue;">`uk.eu.globalcorp.com`</mark>_
    * Manages UK-specific resources and users.
    * OU: Users, User: _<mark style="color:blue;">`alice.smith`</mark>_.
  * <mark style="background-color:blue;">**Trusts**</mark>:
    * Parent-child trust: _<mark style="color:blue;">`globalcorp.com`</mark>_↔ _<mark style="color:blue;">`na.globalcorp.com`</mark>_.
    * Parent-child trust: _<mark style="color:blue;">`eu.globalcorp.com`</mark>_ ↔ _<mark style="color:blue;">`uk.eu.globalcorp.com`</mark>_.
    * Transitive trust: _<mark style="color:blue;">`globalcorp.com`</mark>_ ↔ _<mark style="color:blue;">`uk.eu.globalcorp.com`</mark>_ via _<mark style="color:blue;">`eu.globalcorp.com`</mark>_.
  * <mark style="background-color:blue;">**Cross-Domain Access**</mark><mark style="background-color:blue;">:</mark>
    * G\_SalesUsers (from _<mark style="color:blue;">`na.globalcorp.com`</mark>_) is a member of DL\_FileAccess (in _<mark style="color:blue;">`globalcorp.com`</mark>_), granting access to the file server.
    * A user (alice.smith in _<mark style="color:blue;">`uk.eu.globalcorp.com`</mark>_) accesses a resource in _<mark style="color:blue;">`na.globalcorp.com`</mark>_ via transitive trusts.
* <mark style="background-color:blue;">**Functionality**</mark>:
  * <mark style="background-color:blue;">**Authentication**</mark>: A user in _<mark style="color:blue;">`uk.eu.globalcorp.com`</mark>_ logs in, and Kerberos uses the trust path to authenticate against a server in _<mark style="color:blue;">`globalcorp.com`</mark>_.
  * <mark style="background-color:blue;">**Resource Access**</mark>: john.doe in _<mark style="color:blue;">`na.globalcorp.com`</mark>_ accesses    _<mark style="color:blue;">`\\fileserver.globalcorp.com\Shared`</mark>_ via G\_SalesUsers membership in DL\_FileAccess.
  * <mark style="background-color:blue;">**Administration**</mark>: Domain Admins in _<mark style="color:blue;">`na.globalcorp.com`</mark>_ manage their domain, while Enterprise Admins in _<mark style="color:blue;">`globalcorp.com`</mark>_ oversee the tree.

***

