Active Directory Design for Multi-Site Enterprises

AD design decisions made early have long-lasting consequences. This guide covers forest, domain, site, and replication topology design.

Single Forest vs Multiple Forests

Single forest (recommended for most):

Centralized administration
Seamless SSO across all domains
Lower operational overhead

Multiple forests when needed:

Acquisitions with incompatible schemas
Legal/regulatory separation requirements
Security isolation requirements

Domain Design

For a holding company with subsidiaries:

TEXT

Forest root: corp.local (resource minimal — no user accounts)
├── Child: hq.corp.local      (HQ users, servers)
├── Child: subsidiary1.corp.local
└── Child: subsidiary2.corp.local

Or simpler with OUs:

TEXT

Single domain: corp.local
├── OU=HQ
│   ├── OU=Users
│   ├── OU=Computers
│   └── OU=Servers
├── OU=Branch1
│   ├── OU=Users
│   └── OU=Computers
└── OU=Subsidiary1

Sites and Subnets

Define one AD site per physical location:

POWERSHELL

# Create sites
New-ADReplicationSite "HQ-Tehran"
New-ADReplicationSite "Branch-Mashhad"

# Create subnets
New-ADReplicationSubnet -Name "10.1.0.0/16" -Site "HQ-Tehran"
New-ADReplicationSubnet -Name "10.2.0.0/16" -Site "Branch-Mashhad"

# Create site link
New-ADReplicationSiteLink -Name "HQ-to-Mashhad" -SitesIncluded HQ-Tehran,Branch-Mashhad -Cost 100 -ReplicationFrequencyInMinutes 15

DC Placement

HQ: 2 DCs minimum (one as PDC Emulator/RID/Infrastructure master)
Branch with 50+ users: 1 local DC (RODC preferred if untrusted site)
Small branches (<50 users): No local DC, rely on WAN

RODC for Remote Sites

Read-Only Domain Controllers for sites with poor physical security:

POWERSHELL

Install-ADDSDomainController -DomainName corp.local -ReadOnlyReplica -SiteName Branch-Mashhad -Credential (Get-Credential)

RODC caches passwords only for approved accounts — if stolen, blast radius is limited.

GPO Design

TEXT

Default Domain Policy: Password/lockout policy only
├── GPO-Baseline-Workstations: CIS benchmark settings
├── GPO-Baseline-Servers: Stricter security
├── GPO-Software-Corp: Core software deployment
└── GPO-Proxy-Settings: PAC file URL