Mastering Active Directory

Forest root domain

The first domain set up in the forest becomes the forest root domain. This root domain contains two important privileged groups, which are Enterprise Admins and Schema Admins. Members of these security groups can add/remove domains and modify the Active Directory schema.

In the multiple domain model, there are two types to define the forest root domain:

• Dedicated forest root domain: A separate domain to operate as the forest root domain. It will not contain any regular user accounts, objects, or resources. It will contain only the service administrator accounts. All other domains in the forest will be child domains for this root domain. In a single domain environment, domain administrators can add themselves to the Enterprise ...