active directory in parent-child domain

  • Thread starter Thread starter kiko jimenez
  • Start date Start date
K

kiko jimenez

hi all,

i'll be setting up a new child domain for my company. the question is: Can i
create the accounts in the parent domain and have these account replicated
to the child domain? we will be using exchange at the parent domain and have
our's clients connect to the exchange server. this is the reason why i want
to create the account at the parent domain. is there any other way to
accomplish this.

thank you,
kiko jimenez
 
Kiko,

No, it does not work that way. There are three Naming Contexts, or
Partitions, in Active Directory. They are the Schema NC, the Configuration
NC and the Domain NC. The first two are forest-wide and the last is
domain-wide. So, what does this mean?

It means that the forest-wide 'stuff' will replicate to each Domain
Controller in the entire forest. However, the domain-wide 'stuff' will
replicate to each Domain Controller in that specific domain.

So, if you have a parent domain and a child domain then you have two
different, separate domains and, thus, two separate Naming Contexts. So,
this is not going to happen!

If you are worried about Exchange and the user account objects in the
child-domain not being able to make use of Exchange then do not worry. This
is really easy.

Please take a look at the following:

http://www.msexchange.org/tutorials/MF002.html
http://www.msexchange.org/tutorials/MF017.html

Kiko, please do not misunderstand me. I am not trying to be rude. It seems
that there are some very basic concepts here that you are not understanding.
I might not want to be the person responsible for the corporate network if
these basic concepts were not crystal clear. I would like to suggest to you
that you find three or four computers and build yourself a test environment
so that you can 'play' with WIN2000 and Exchange 2000. There is really a
lot to know. This is how I started. Just playing in the lab. I would read
the newsgroup and try to figure things out in the lab. And if I messed
things up I could always format and install and start over. Not really the
case in the production environment.

If you have any more questions please feel free to post them. We are here
to help you! And I am glad that you posted this question. It is a good
start!

--
Cary W. Shultz
Roanoke, VA 24012
Microsoft Active Directory MVP

http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com
 
So the bottom line here is that you probably do not need a second domain.
You really need to control what you have and make sure that you don't assign
permissions to objects that don't need them.

Additionally, if you are concerned about Exchange; you can do a lot with
alternate naming contexts (SPNs) and different datastores.

--
Ryan Hanisco
MCSE, MCDBA
FlagShip Integration Services
Chicago, IL
 
Back
Top