In a complex a tedious environment it's essential that you understand how the various components such
as organizational units domains and forests form boundaries for authentication resource access and searches.
This lesson describes the types of boundaries that aided is demand sound forest provide.
These boundaries usually form the criteria for a then whether an organization deploys multiple domains
or forests next two lessons will cover this in more detail.
Please note that the forest is the only real security boundary in 82 years.
Within an 80 days forest domains do not provide a complete security boundary because account such as
the Enterprise admins group from the forest through route domain have administrative permissions in
each domain.
Now ADT has demand sound forests provide different types of boundaries in an 80 days deployment and
an understanding of the different types of boundaries is essential to manage a complex 80 days in a
wire moment.
Let's take a closer look at ADT as domain boundaries.
An Active Directory Domain provides the following boundaries replication boundaries for the domain partition
all aided as objects that exist in a single domain are stored in the domain partition in the ADA it
is database on each domain controller in the domain.
The application process ensures that all organization updates replay key to all of the other domain
controller in the same domain data in the domain partition does not replicate the domain controllers
in other forests.
The next boundary is administration boundary by default on ADT as domain includes several groups such
as the domain admins group the domain sediments group has full administrative control over the domain.
You can also assign administrative permissions to user accounts and groups within domains with the exception
of the enterprise sediments group in the forest through domain administrative accounts do not have any
administrative rights in other domains in the forest or in other forests.
The next boundaries group policy application boundary you can link group policies sadness at the following
levels local site domain and organizational unit.
Apart from site level group policies settings the scope of group policy is the aid it is domain.
There is no inheritance of group policies sentence from one end it is the main to another.
Even if 180 days domain is lower in the hierarchy than are there in a domain 3 the next boundary is
audit and boundary.
Auditing is central and managed by use in group policy objects.
The maximum scope of this sentence in the edit is domain.
You can have the same audit sentence indifferent to 80 days demands but you must manage them separately
in each domain.
The next boundaries replication boundary for domain name system zones one of the options when you configure
DNS zones in a in an edit is in one moment is to configure Active Directory integrated zones.
This means that instead of local is storing DNS records and text files on each DNS server they are stored
and replicated in the ADT database.
The administrator can then decide whether to replicate the DNS information to all domain control or
so the domain regardless of whether they are DNS servers or replicate them to all domain controllers
that are DNS servers in the domain or replicate them to all the main controllers that are DNS servers
in the forest.
So this is you to decide how to replicate this DNS information by default.
When you deploy the first domain controller in an entity as domain and configure that server as a DNS
server to separate application partitions which are domain DNS zones and as darkness zones are created
the domain DNS zones partition contains domain specific DNS records and is replicated only to other
DNS servers that are also Active Directory Domain Controllers in the domain.
So all these boundaries are active directory domain boundaries.
Now let's review Active Directory forest boundaries and did.
Forest provides the following boundaries security boundary the forest boundary is a security boundary
because by default no account outside the forest has any administrative permissions inside the forest.
The next forest boundary is replication boundary for the schema partition the schema partition contains
the rules and syntax for the edit is database.
This is replicated to all the domain controllers in the 80 days forest.
The next forest boundary is a replication boundary for the configuration partition.
The configuration partition contains details about the edit it is the main layout including domains
domain controllers replication partners site and subnet information and dynamic Host Configuration Protocol
authorisation or dynamic access control configuration.
The configuration partition also contains information about applications that integrate with the edit
is database.
For example Microsoft Exchange server.
This partition is replicated to all domain controllers in the forest.
The next boundary is replication boundary for the global catalogue.
The global catalogue is on the list that contains every object in the entire 80 days forest to keep
it to a manageable size.
The global catalog contains only some attributes for each object.
The global catalog is replicated to all domain controllers in the entire forest.
There are also global catalog sorrows and the last forest boundary is a replication boundary for the
forest DNS zones.
The forest DNS zones partition is replicated to all domain controllers in the entire forest that are
also DNS servers.
This zone contains the records that are important to enable forest wide DNS name resolution.