Score:0

Parent domain vs Child domain

pk flag

As far as I know, a child domain's fully-qualified domain name (FQDN) must be a subdomain of the parent domain's FQDN. Also an implicit trust (two way - transitive) is established between them.

Are there any differences between the child domain and a parent domain? Are there any things that a parent domain can control or do to a child domain that a child domain can't do to a parent domain?

Semicolon avatar
jo flag
The domains don't exert control over eachother -- the accounts delegated or configured with appropriate administrative access do.
cn flag
Active Directory supports disjointed namespaces. The DNS namespace of a child domain may be different than the parent domain.
Semicolon avatar
jo flag
A domain in a disjointed namespace is by definition NOT a child domain.
Score:0
cn flag

No, the domains each provide a security boundary and don't do anything to each other. The forest config, however, may affect both domains.

The main practical difference is that, by default, members of Domain Admin in the root domain may add themselves to Enterprise Admins and do the tasks allowed by that role. Of course, members of any child domain can be added to Enterprise admins as well. Anyone who is a member of Enterprise Admin has full admin rights to child domains.

Outside of Enterprise Admin, though, anyone who needs to access resources in a different domain needs to be granted explicit permissions. You should understand how to use AD groups and groups scope (like Universal vs Global vs DomainLocal) if you need to manage access to resources between domains.

You should always carefully consider why you might want a child domain at all. Other than perhaps academic environments (e.g to easily separate staff resources from student accounts) or similar limited use-cases such as very large enterprises, there aren't many scenarios where they'd be highly desirable. Remember, more domains = more DCs = more management and maintenance overhead. Also, if you plan to or are currently using cloud services like Office365, etc, that can cause additional complexity.

Much of what people tend to use child domains for can be done by better OU management and decent role definitions and rights delegations.

Allan avatar
pk flag
You said ' Anyone who is a member of Enterprise Admin has full admin rights to child domains ' . I saw that Enterprise Admin has control over all the Domains in the forest regardless of the child or parent relationship. Is it?
LeeM avatar
cn flag
Sorry, yes. All domains in the forest including the root- "children of the forest" was kind of how i was thinking of it.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.