Two AD W2K3 Design Questions

[Peter]

1. What are the REAL reasons for using an empty root domain? I get all kinds
of answers but really would like to now hard facts.

2. Are there a reason to partition an AD in one domain per country? E.g.
from som GPO policys etc or could everything (except password complexity) be
set on OUs instead?

Thanks for your input.

/Peter

 

[Matjaz Ladava [MVP]]

One is to protect EA and SA accounts and have different password policies,
but in my opinion you can easily gain EA rights from child domain due to
SIDHistory exploit. Beside this you need two aditional DC's (at least) to
support empty root domain.

Use more domains, if you have different password policies requirements, as
this is per domain basis. You can rather implement one domain with sites as
you can have GPO's on sites.

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Peter]

So the same problem with LocalSystem account exists in a native 2003
forrest?
/Peter

 

[Matjaz Ladava [MVP]]

You were thinking of ?

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)