Building Active Directory

[Andrew Roberts]

would have a head office in Europe with about 20 or 30 people. I would then
have a second office in Europe located in a different country. Second
European site would have 10 people. I would then have a small site in the
United States of about 5-10 people. I was going to connect the sites with
vpn connections with pix firewall routers over ADSL.

My questions relate to the design of the active directory that i would have
to build. Is it better to build one domain at the head office, and then have
the other offices as sites off the domain? Or is it better to have one big
domain at the head office and then have subdomains at the other offices,
being different countries? For example if i had the head office in London,
and second office in Stockholm and third office in New York. Should i name
the head office uk.abc.com. The second office se.abc.com and the third
us.abc.com. With this setup i would actually need two domain controllers at
the head office, one for the domain abc.com and one for uk.abc.com as the
sub domain.

Also, deploying software in this setup i believe wont change a lot, as long
as the deployment was done from the abc.com domain and not from the
subdomain, if it was done from the domain of us.abc.com and the computer
moved to se.abc.com then there could be some problems? or not?

Last question, is there any great difficulties in using windows XP on a
windows 2000 domain. I believe the answer is no, but is it better to stick
to windows 2000 workstations, or move to windows xp?

Thanks
Andrew

 

[Marc]

Andrew, it depends on the the degree of complexity you
are willing to put up with. If there are EU requirements
for seperation of countries, then you might have to make
seperate domains for each country. I know Germany and
Sweden had strict privacy laws that might encourage
this. On the other hand, for simplicity sake, giving
each area there own OU can make sense if you looking for
group policy and delegation control to each region via
OU's. Sites are needed when controlling replication and
for authentication management when DC's are serving
limited geogrphically unique subnets.

As for policy on XP machines on a windows 2000 domain,
make sure you have the XP templates on all of your
windows 2000 domain controllers and you should be set.
Windows XP seems to be a better choice from a longevity
standpoint if you look at MS's committed support
timeline. Of course this assumes your applications will
run ok on Windows XP.

Regards,
Marc