In this lesson, we'll talk about what is an AIDS forest.
A forest is a top level container in AIDS.
Each forest in a collection of one or more domain trees that share a common directory schema and a global
catalog.
A Domain Tree is a collection of one or more domains that share a contiguous namespace.
The first domain that you create in the forest is called the Forest Root Domain.
The forest root domain contains a few objects that do not exist in other domains in the forest because
you always create these objects on the first domain controller, a forest can consist of as few as one
domain with a single domain controller, or it can consists of hundreds of domains across multiple domain
trees.
The following objects exist only in the forest root domain.
We've got schema master role, which exists only in the forest root domain because it is a special forest
wide domain controller role.
Only one schema master exists in any forest.
You can change the schema only on the domain controller that holds the schema master.
Another object is the domain name in master role.
This is also a special forest wide domain controller role.
Only one domain name in master exists in any forest.
Only the domain name in master can add new domain names to the directory.
Next stop the Enterprise Admins Group.
By default, the Enterprise Admins Group has the administrator account for the forest root domain as
a member in the Enterprise Admins Group is a member of the local administrators group in every domain
in the forest.
This allows members of the Enterprise Admins Group to have full control administrative rights to every
domain throughout the forest.
And the last object that exists only in the forest domain is the Schema Admins group.
By default, the schema admins group has no members.
Only members of the Enterprise Admins Group or the domain admins group in the forest domain can add
members to the Schema Admins group.
Only members of the Schema Admins group can make changes to the schema.
Now some words about security boundary and replication boundary.
An Active Directory forest is a security boundary by default.
No users from outside the forest can access any resources inside the forest.
Typically, the organization creates only one forest, although you can create multiple forests to isolate
administrative permissions among different parts of the organization.
By default, all the domains in the forest automatically trust the other domains in the forest.
This makes it easy to enable access to resources such as file shares and websites for all the users
in the forest, regardless of the domain to which they belong.
So please remember that by default the domains in a forest automatically trust the other domains.
In the forest.
We've got also replication boundary and Active Directory forest is the replication boundary for the
configuration and schema partitions in the Active Directory database.
As a result, all the domain controllers in the forest must share the same schema.
Because of this, organizations that want to deploy applications with incompatible schemas need to deploy
additional forests.
The Active Directory forest is also the replication boundary for the global catalog.
The global catalog makes it possible to find objects from any domain in the forest.
For example, the global catalog is used whenever user, principle, name or UPM signing credentials
are used, or when exchange server address books are used to find users.
So to wrap up, the following objects exist only in the forest root domain.
This.
In my master role, the domain name in Master Role, the Enterprise Segments Group and the Schema Admins
Group.
Only members of enterprise admins or domain admins for forest domain can add members to the Schema Admins
group, and only members of Schema Admins Group can make changes to the schema.
And we've got security boundary which is for a forest boundary and all domains in a forest automatically
trust the other domains in the forest.
And we've got replication boundary which exists for configuration and schema partitions, replication
in the Active Directory database and for the global catalog.