Bink.nu Services

Subscribe to our feed 

 


Order Now!

Windows 7 for XP Professionals
Updating Support Skills from XP to Windows 7
by Bink.nu's Raymond Comvalius

Who is online

There are 145 guest(s) online.

There are 0 member(s) online.

Sponsors



Advertisements

empty root domain ??

Last post 08-05-2006 22:51 by johlos. 1 replies.
Page 1 of 1 (2 items)
Sort Posts: Previous Next
  • 08-05-2006 14:48

    • STU
    • Top 50 Contributor
    • Joined on 09-26-2003
    • U.A.E
    • Posts 78

    empty root domain ??

    Whats the benifit of having an empty root domain and how to create it ?

  • 08-05-2006 22:51 In reply to

    • johlos
    • Top 25 Contributor
    • Joined on 09-30-2004
    • Bonney Lake, WA, USA
    • Posts 302

    Cool [H] Re: empty root domain ??

    You would create the empty root when doing the initial setup of the forest.   You'd create the forest root and add at least 1 additional DC to this domain.   Then after those DCs are replicating with each other, you'd create a child domain within the forest and populate it with multiple DCs (this child domain could also be an existing NT4 domain you're upgrading to W2K/W2K3).

    But if you've already got an existing W2K/W2K3 domain running, you can't add a new forest root on top of it.

    As far as the benefits?   When W2K first released, empty roots were all the rage and folks thought it was the best thing since sliced bread.   Anyone in the "Domain Admins" group in the forest root domain could easily add themselves to "Enterprise Admins", "Schema Admins", and could then do whatever they wanted within the forest.   So the benefit of the empty root is that you'd likely have extremely few folks with DA membership in the root, while you would probably have more in the child domain.   If you only have a single child domain and the group of admins managing the forest are the same ones as the child domain, then an empty root wouldn't help you any.   If you have multiple child domains, and the DAs in those children aren't necessarily the ones who'd be getting EA privs, then an empty root can be useful.

    Though if you're looking at putting up a new forest, you should REALLY be considering doing this with Windows Server 2003 SP1 or Windows Server 2003 R2 DCs instead of W2K3 SP4 (+post-SP4 Rollup 1) DCs.   W2K3 DCs perform much better than W2K ones, they have better Disaster Recovery options available (the ldifde file created during an auth restore for re-populating group memberships of restored objects in particular that was introduced in SP1), but more importantly, W2K is already in Extended Support and only has about 4 years of life left in it.   Even if you build them with W2K3 SP1, still apply the schema extensions from CD2 of W2K3R2 (adprep /forestprep, adprep /domainprep) since other R2 features on domain members will require this (such as DFS-R).

     

Page 1 of 1 (2 items)
Bink.nu 3.0. Copyright © 1999-2012 Steven Bink. All Rights Reserved.
Microsoft and Microsoft logo's are trademarks of Microsoft Corporation.