Re: Child Domain Structure

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

hi,

as a continuation of this thread i have some further thoughts.

the principle reason i presumed a child domain would be suitable is thus.
the location for the child is actually overseas and although the security of
the location is good we are very conscious that it is out of physical touch
and cannot be policed by administration on site. Using a child domain would
create a further security boundary and allow us to be more granular with
security. Does my reasoning make sense?

What do you guys think.

"Cary Shultz" wrote:

Andy,

Generally speaking I would suggest that you stick with a single domain and
simply set up another Site in ADSS. I really do not see anything in what
you have written that screams out "child-domain". Create the correct
security groups, make the correct user account objects members of the
appropriate security groups and use Share/NTFS permissions to control access
to shared resources.

I see this sort of thing all the time (creating a child-domain when it
really is *probably* not necessary) and it is ultimately undone (by me).
Things usually work better after that (well, I would have to explain that
and will not at this time...time to go to bed).

--
Cary W. Shultz
Roanoke, VA 24012

"Andy Wolsten" <AndyWolsten@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1EE9AC9B-DADF-4103-BE3F-8ABAAA65A006@xxxxxxxxxxxxxxxx
Hi,

I currently have a domain mydomain.local and require to add a remote
location to our infrastructure. I am considering two options

1- adding the remote location with a dc to mydomain.local
2- creating a child domain remote.mydomain.local

Option 2 is prefered as there needs to be some security borders between
users at the remote location and those in the parent domain. There are
varous
users who only require access to that domain however, there are users who
will require access to resources at both locations and some resource
sharing
going on betwen domains.

- Can anyone suggest a DC/domain solution to provide a secure setup
- Would users in mydomain.local log be able to log in to computers etc at
remote.mydomain.local and access resources if option 2 is implemented
- Would users at the remote.mydomain.local be able to log in to
mydomain.local and access their global resources if option 2 is
implemented
or would users require two login accounts, one for each domain?
- Would there be a requirement for domain trusts to be activated between
the
two domains in order to share resources, shares, printers, folders etc?
- Would this be more acheivable simply using a single domain, adding the
remote site using option 1.

I hope all this makes sense.

Thanks



.

Relevant Pages

  • Organisational aspects in security design
    ... the fundament of IT security. ... assignment of responsibilities through to the distribution of control ... Lack of resources or unsuitable resources ... Rights of admission and of access to hardware and software are applied ...
    (comp.security.misc)
  • Re: User Placement in Child Domain Based Forest
    ... Systems Administrator ... Because either the Administrators at top root can administer ... adding them self to higher security groups. ... create the child domain for the wrong reasons, ...
    (microsoft.public.windows.server.active_directory)
  • Re: 2003 Domain / Child Domain
    ... How would this benefit over having a child domain? ... > configured as a child domain precisely because of the trust and security ... > separate forest; there is no automatic trust. ...
    (microsoft.public.windows.server.general)
  • Re: 2003 Domain / Child Domain
    ... How would this benefit over having a child domain? ... > configured as a child domain precisely because of the trust and security ... > separate forest; there is no automatic trust. ...
    (microsoft.public.windows.server.general)
  • Re: Distribution group kept changing
    ... Could be anything, public folders, calendars, folders in a mailbox. ... Trying to locate the resources the group is being applied to could be extremely difficult unless you have a very small deployment or you have scripts that can enumerate through all permissions. ... if a distribution group is being used to secure ANY exchange resource, exchange will security enable the group....with "security enable the group" is what is meant by converting a distribution group to a security group ... These groups we created are distribution groups and for email purposes. ...
    (microsoft.public.windows.server.active_directory)