Re: emtpy root domain

From: John M (JohnM_at_discussions.microsoft.com)
Date: 11/18/04 

Date: Wed, 17 Nov 2004 23:27:01 -0800

well I dont really have any requirements, other than this,

1. need split dns.
2. would like a dmz area dont care what its called. this would have limited
file access to the main (internal) domain. will also be the mail / smtp
gateway for the (internal) domain as well.
3. be nice to be able to have a test domain or area which has semi
connectivity to prod domain or area.
4. have a test AD area to test migrations / scripting into AD.

the suggestion of empty root keeps popping up everywhere i look. so I did a
couple of vmware / testing type builds and noticed the security enterprise
groups were in the external domain.

my thoughts were this wasnt that secure particularly if the external domain
was in the DMZ. my reasoning was that if the DMZ was compromised for some
reason being that the enterprise groups were in the DMZ you may as well say
the (internal) domain was also compromised.

this leads me to believe that most dmz's would actually house a separate
forest. or not even a domain.

then my next issue is how does one span this across multiple geographic
sites. do the vpns go from (internal - internal) or external-external domain

note: this is all hypothetical general best practice sort of stuff.

"Al Mulnick" wrote:

> The only true security delineation is the forest. That said, you may have
> better luck if you look at this in a different way. Look at it as DNS only
> and as Active Directory only. Two separate problems to be solved vs. just
> one big jumble. It may make more sense to you that way.
>
> Empty root is good for some restrictions and especially policy differences,
> but since the domain is not a true security boundary (but more like a DNS
> boundary although not quite that simple) it really only makes sense if you
> want to use different policy for enterprise admins than you do for the rest
> of the population. Otherwise, I don't see a huge advantage. It's about
> control not namespace. You can have disjointed namespaces in the same
> forest, and you can have split-brain dns in the same network if that's what
> you need.
>
> Can you expand a little on what the end solution needs to be?
>
>
> "John M" <John M@discussions.microsoft.com> wrote in message
> news:558AD8A2-00F1-40CC-B0BF-102B90646532@microsoft.com...
> >I have been messing around with AD structures mainly for the sake of
> >finding
> > a good model.
> >
> > I have been looking it the empty root model which has some appeal. However
> > I
> > did notice that the following happened.
> >
> > domainName.com = empty root
> > internal.domainName.com = child of empty root.
> >
> > now my theory was that the domainName.com would be in the DMZ, which would
> > mean that if that domain was compromised then so would the internal
> > domain.
> >
> > being that the enterprise accounts are in the empty root ?
> >
> > am i correct in saying that the empty root model really needs another
> > domain
> > in a dmz ?
> >
> > i have also read that trends are moving away from this model, however i
> > dont
> > know to what they are going too ? the reason the empty root appeals is it
> > would make it simple to create this type of scenario.
> >
> > domainName.com
> > internal.domainName.com
> > test.domainName.com
> >
> > etc etc
> >
> > how can this be done and have a good security model as well ?
> >
> > am i missing something here ?
>
>
>

Relevant Pages

  • Re: Using Microsoft DNS for Public domains
    ... addresses that forward to my two nameserver DNS Servers on my home machine, ... the public IP addresses pointing to the internal DMZ IP addresses. ... >> name I registered two nameservers at my registrar. ... >> the internal DMZ IP of the primary DNS server. ...
    (microsoft.public.windows.server.dns)
  • Re: Domain Controller That Service a DMZ
    ... Where DNS resolution is done, and what resolution path is used, is ... you evidently have machines in that DMZ on which people can ... > for authentication, group policy, etc for the DMZ. ... > the DMZ to be able to use the DMZ domain controller to lookup the DNS ...
    (microsoft.public.windows.server.security)
  • Re: When you run Dcpromo.exe on Windows 2008 to create a replica domain controller, you receive a me
    ... A DMZ is used for servers that are accessed from the outside world with public ip addresses. ... so we can exclude DNS as a problem. ... server has no problem joining the domain. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Trusting external domain
    ... allow zone transfers to the IP's on the other domain's DNS servers. ... Create secondary DNS zones in each domain for the other domain (eg: ... down your firewall access from the DMZ to your internal domain). ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD Authentication on a DMZ ?
    ... How can I publish an application that is on my DMZ and that is using Active Directory authentication? ... The ports listed in our article only refers to ports needed to be open for replication, ... I dont want to put a domain controller on the DMZ for security reason. ... I would prefer to let the DC on the LAN and to configure my IIS Webserver in the DMZ to use "AD Authentication". ...
    (microsoft.public.windows.server.active_directory)