You know,
Microsoft recommends that most of its customers, if you're in a privileged
position to do a forest design, is to stay with a single forest,
single domain topology.
If your business has too much sprawl,
maybe multiple domains within a forest or maybe a multiple forest architecture,
you might want to consider consolidation.
Used to be years ago that you had to do multiple domains if you had
different groups who had different password requirements. Of
course, we've had fine‑grained password policies for a long time,
so that is no longer a necessity.
A common mistake I've seen people make in the real world is
believing that the domain is the security boundary,
which is not true.
In Active Directory Domain Services,
it's actually the forest that's the security boundary for the environment.
And if your business does legitimately have need for complete isolation,
then yeah,
I'm not saying that this is all or nothing, but if
everybody's playing on the same team and you want to have
a unified security infrastructure,
I would strongly recommend simplifying your environment to one forest
in either multiple domains in a single tree or a single domain. A
domain can support up to about 100,000 objects.
Now, if you're a business as big as Microsoft,
you're going to have to have at least multiple domains
within a single forest, but for many businesses you can
comfortably fit in a single forest, single domain infrastructure. That limit,
that object limit, is going to depend on things like the amount
of bandwidth you have available and so forth.
But generally speaking,
that's a pretty healthy limit. I submit to you that
needlessly or in a misguided way,
increasing complexity, and what I mean is creating multiple domains,
multiple domain trees, and multiple forests, ultimately may actually reduce
your security because there's simply too many edges and too much going on, too
many plates spinning, if you don't mind the corny metaphor. I would submit
that having a simpler AD infrastructure,
particularly single forest,
single domain, gives you and your security team a much
better grasp and a much easier time in terms of doing a
unified security policy. And lastly, by simplifying your forest,
you're saving on replication bandwidth.
Think of global catalog and universal group movements, these sorts of things.
The trust relationships that are automatic between domains
within a forest, and then if you have inter forest trusts
that are uni or bidirectional,
all of the extra replication that's necessary to support
that environment. You may want that network bandwidth going to more high impact services.