Implications Of Creating The Multiple Forests

By Author: kennie
Total Articles: 129
Comment this article

Adding a forest dramatically increases administrative and usability costs. When determining free 70-297 test questions whether to create multiple forests, keep the following administrative issues in mind:
Each forest has its own schema. You need to maintain the contents and administration group memberships for each schema separately even if they are
similar.
Each forest has its own configuration container. You need to maintain the contents and administration group memberships for each configuration container separately even if they are similar.
A one- or two-way forest trust is permitted between forest root domains in two different forests. You must explicitly (manually) set up and maintain this
trust, which allows all domains in one forest to transitively trust all domains in another forest. A forest trust is not transitive across three or more forests.
Replication of objects between forests is manual and requires the development of new administrative policies and procedures.
Merging forests or moving domains Forests cannot be merged in a one-step ...
... operation; you must clone security principals, migrate objects, decommission
domain controllers, downgrade them to member servers, and add each to the new forest domain.
Although objects can be moved between forests, you must use the 70-297 practice test ClonePrincipal tool to clone security principals in the new forest, or the
Ldifcle.exe command-line tool to move other objects.
Default user principal names (UPNs) must be maintained for smart cards to be able to log on across forests.
Each forest must contain at least one domain. Additional domains increase hardware and administrative costs.
When determining whether to create multiple forests, keep the following usability issues in mind:
Unless a forest trust is created, when a user logs on to a computer
outside his or her own forest, he or she must specify the default UPN, which contains the full domain path for the user account, rather than just the easy-to remember abstracted UPN. The default UPN is required because the domain controller in the forest will not be able to find the abstracted UPN in its global catalog. The user's abstracted UPN resides only in the global catalog in the user's forest.
User queries Unless a forest trust is created, users must be trained to make explicit queries across all of an organization's forests. Incomplete or incorrect queries can affect how users perform their work.
All the reasons for creating multiple forests involve administrative issues. However, the negative effects of a multiple forest scenario have the greatest impact on users. Unless you plan to create and administer forest trusts to make the use of free exam papers multiple forests in your organization appear transparent to users, you should try not to create separate forests.
To create additional domains, trees, or forests, you use the Dcpromo command and the Active Directory Installation Wizard.