Mastering Active Directory - Second Edition

The forest root domain

The first domain that's set up in the forest becomes the forest root domain. This root domain contains two important privileged groups, which are Enterprise Admins and Schema Admins. Members of these security groups can add/remove domains and modify the Active Directory schema.

In the multiple domain model, there are two types that you can use to define the forest root domain:

• Dedicated forest root domain: A separate domain to operate as the forest root domain. It will not contain any regular user accounts, objects, or resources. It will only contain the service administrator accounts. All the other domains in the forest will be child domains for this root domain. In a single domain environment, domain administrators ...