Problem solve Get help with specific problems with your technologies, process and projects.

What Active Directory model makes division separation easiest?

We are a company with several divisions and we are considering moving to Windows 2000 and Active Directory (AD). We currently have NT domains per division plus a central controlling domain. Divestiture of some divisions is on the cards in the next year or so. What AD model would make separation of divisions easiest?
Generally in Windows 2000 Active Directory it is easier to manage organizational units (OUs) instead of multiple domains. Multiple domains -- especially if you need to share resources between the various domains -- can result in the need for additional hardware to support the infrastructure. You will need two Global Catalog Servers for each of the domains present in the geographical locations (or closest subnet) of the other domain users that need to share the resources. However, there are some compelling reasons to create additional domains:

  • Account policy differences (account policies are always domain-wide and cannot be applied to OUs)
  • Separation of business model (this would be along the lines of your divestiture of some of the business divisions)
  • Separation of IT responsibility (if each division has its own IT staff and there is no desire/movement to bring the work under a central staff)

    The use of OUs generally offers you more flexibility in management, application of group policy and movement of objects within the entire infrastructure. However, for the reasons stated above, I would suggest that you consolidate only those divisions that do not look to be divested at any time. If a business decision is made to divest -- it is just a little more work and planning that you will need to do to move them out into their own domain and send them on their merry way. For those divisions already earmarked -- keeping separate domains would be the best configuration.

  • This was last published in December 2002

    Dig Deeper on Microsoft Active Directory



    Find more PRO+ content and other member only offers, here.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

    Please create a username to comment.