MCITP 70-640: Active Directory forest and trees

MCITP 70-640: Active Directory forest and trees

Welcome back to your free training course
for Active Directory. In this video I will look into how Active Directory is represented
in an enterprise environment. To make things simply let’s start with one network.
In this network you have ITFreeTraining. All the users in ITFreeTraining can access
resources in ITFreeTraining assuming they have permission to do so. All the users in
ITFreeTraining belong to the one domain. A domain is defined as a logical group of
computers that share the same Active Directory database.
Regardless of how big your network is and how many places around the global it is located,
when possible you want to keep your network to just one domain. In the real world this
is not always possible. Active Directory in Windows Server 2008 can
scale easily to millions of objects but there are many reasons why you may have a network
with more than one domain. This could be because of limitations in earlier version of Active
Directory to the company structure and politics. Imagine that you had a secure department in
your company that held all the Intellectual property for the company. For maximum security
the company puts people who work in this department in their own domain and even hired there only
IT support staff. This separate department could be added to
the original domain as a child domain. In this case the new child domain is called secure
dot When you have two domains like these that share the same
root name space, in this case ITFreeTraining dot com, these are referred to as being in
the same tree. ITFreeTraining is at the top of the tree so it is considered to be
the root domain. To illustrate this better, you could add yet
another domain called sales. As long as sales shares the ITFreeTraining dot com name
space it is part of the tree. Under sales dot ITFreeTraining dot com you could even
add additional child domains called east and west.
All these domains share the ITFreeTraining name space and thus are considered to be in
the same tree in Active Directory. Each domain however has its own group of user and computers
and thus means each domain has its own Active Directory database.
The advantage of having domains like these in the same tree is that Active Directory
will automatically create trusts between the child and parents domains. These trust relationships
allow members of each domain to access resources in any other domain assuming that they have
access. The next question is what would happen when
you add another domain that has a different name space to the other domains. For example,
if I added the domain high cost training dot com. When this happens the new domain, high
cost training will be part of a new tree. I now have two trees, the ITFreeTraining
tree and the high Cost Training tree. So far I have looked at the root domain and
child domains in a tree but there is one structure that links all these together called a forest.
A forest encases multiple domains and trees into one structure. You don’t have to have
multiple domains and trees to have a forest. To illustrate this I will go back to my original
example of one domain. As soon as you create your first domain a forest is automatically
created for that domain. When I added the two child domains to IT
Free Training these now form a tree in the one forest. The high cost training domain
is then added and this forms anther tree in the same forest. So why is there a need to
have a forest? All domains in a forest have something in
common. They share what is called the schema. The schema defines the Active Directory database.
The schema determines what can be stored in the database and the structure of that data.
Each domain has its only copy of the database but it is the schema that determines its design
and the schema is shared between all domains in the forest. When changes are made to the
schema these changes are replicated to every domain in the forest.
The advantage of having a forest is that all domains in a forest also have trust relationships
generated automatically. As shown here, a user in high cost training could access a
resource in east dot The trust relationship is automatically
created between parent and child domains and between trees in the forest. Assuming the
user in high cost training has access they can access any resource in any domain in the
forest. This brings up the question how does one find
items in a forest? In order to find items in a forest you need an index. In any Active
Directory forest there will be servers that provide an index for all items in the forest.
These are called global catalog servers. There is at least on global catalog server per domain.
Global catalog servers or GC’s contain an index of every object in the forest. This
is not a full copy of the object, but enough to allow a user to perform a search. For example,
using a global catalog server you could search a forest for all the color printers. Since
the global catalog contains the basic information about each object in the forest a user can
find this information quickly. The global catalog server does not contain any detailed
information about the printer but it can tell the user where this object is located in the
forest. Think of a global catalog server like an index at a library. The index gives you
an idea what is in the book and more importantly where to find it if you want to know more.
The last example I want to show you is when anther forest is added. This may occur if
your company takes over another company that already has its own Active Directory infrastructure.
Active Directory does support this by an administrator manually creating a trust between the two
forests. In this case there are two forests. Each forest
has it only schema and each domain has its own copy of the Active Directory database.
In the real world you want to reduce the number of domains that you have to the bare minimum.
Having one domain and one forest makes things a lot easier. In cases like these you don’t
have a choice. A separate company is going to have its own Active Directory forest regardless.
In some cases you may need to create a separate forest. For example if you are testing an
application that makes changes to the schema you may decide to put it in its own forest.
By doing this you can be assured the testing of the application does not make permanent
changes to the production network. That’s it for forests, trees and domains.
In the next video I will look at the system requirements to install your first server
for use with Active Directory. We hope you have enjoyed this free training
video. For more free training videos please go to are web site or you tube channel. Thanks
for watching.

Daniel Ostrander

Related Posts

100 thoughts on “MCITP 70-640: Active Directory forest and trees

  1. itfreetraining says:

    Thanks very much and thanks for watching.

  2. itfreetraining says:

    Thanks very and thanks for watching.

  3. itfreetraining says:

    Sorry none of us are experts of Exchange so we can't really answer that one.

  4. Jay Roos says:

    In this video you say to stick with one domain when possible. If you have a situation where you have both staff and public computers would that be a reason to have two domains? Would one be a child domain or would the just be two separate domains in a forest?

  5. Nik Sargent says:

    This video is brilliant – contains all I needed to know about AD and how complex its logical deployment architecture may or may not be. Thank you.

  6. Linda Yount says:

    I just want to say thank you for all of your videos.  

  7. Snekmel says:

    Thanks man you explained it verry wel!

  8. Ram Parasa says:

    Good video .Thanks a lot

  9. MsDawdawdaw says:

    very good

  10. Michael Breton says:

    This video may be years old, but its still very useful in explaining terms for Server 2012 R2 certification.  Thank you.

  11. Pascual Pinel says:

    Good video. I like very much

  12. Miguel Angel Disla says:

    Awesome video. Thanks a lot

  13. Johnny Tirado says:

    Thanks, itfreetraining, the wealth of knowledge in these videos is huge. I'm working to enter into the IT field and knowing this info is critical for me.

  14. Nathan Acuesta says:

    Unbelievable clarity! Thank you!

  15. Sam Burris says:

    Great video! THANK YOU. 

  16. Joel Weidenmark says:

    I LOVE YOU!!!

  17. Deb Roy says:

    awesome n simplest form of explaination

  18. ktrn says:

    Thank you very much!!! 🙂

  19. Lingyun Yang says:

    hey the videos are excellen, thanks very much!
    but I have to say: in 5:52 you said always one gc per domain' isn't that supposed to be 'per forest'?

  20. marcos botta says:

    Thank you very much

  21. Bunnath Chan says:

    thank you am taking a security+ now. your videos help me a lot

  22. Harun Rashid says:

    Thank you so much for the effort, easily done. Much helpful. 

  23. Don Amme says:

    Thanks for this great video, it makes sense now 🙂

  24. Cris John says:

    Thank you, very well explained in details. I got the Thing "ahhhhh" 🙂

  25. Neil Price says:

    Great stuff, very helpful!

  26. crashxxx says:

    I did not found better explanation then this. Perfect.

  27. Duy NGO says:

    You are brilliant teacher! Thank you very much. Keep going!

  28. Mathias Mboya says:

    i have created my test environment and these things are real and working.
    thank you very much for the video.

  29. Bryan Cerrati says:

    Guess what…. I spent 1099$ on train signals server 200or2 raining and it doesnt even touch your free videos via youtube… Thats sad for them!!!! Your very gifted with patience and the ability to teach with out a monotone learn this or die attitude…. Im in love with you and i have subscribed to your channel and made sure anytime you post something it is put directly to the top of every youtube query… Love you and thanks for the great video series.

  30. jopa030 says:

    Very well explained!!! Could not be more clearer than this. Excellent work!

  31. Tiago Toledo Faria says:


  32. L. Cin says:

    Well Explain, if you don't understand the concept of Domain, forest & tree wit this video than you won't understand with nothing or nobody else, Damn the way you explain it is picture and audio perfection.  5 stars

  33. mightymo says:

    Your explanations are gold. Awesome work. Thanks

  34. rahul ahuja says:

    i have never been so engrossed listening to an invisible Speaker. Take a Bow @itfreetraining

  35. Tobias says:

    Thanks! this really helped me out.

  36. Mina Amir says:

    Awesome Explaining … thanx …

  37. Billy Arante says: thank you!

  38. Cesar Ramirez says:

    Pretty clear…..even though it is a hard to grasp concept, you made it easy to understand.

  39. bert torres says:

    this is the video i've been looking for thank you….

  40. Anil Sharma says:

    Very informative, Excellent Information & beautifully explained ..

  41. Kareem Al-Hourani says:

    +itfreetraining thanks a lot for the videos keep it up bro, Cheers.

  42. abishek surendra says:

    Hi itfreetraining
    It is being said that the changes made to the schema cannot be reversed.
    Just curious to know why it being designed so…???

  43. Kenny Diaz says:

    +itfreetraining how can I use active directory in a multi tenant solution? In other words, I would like to administer one active directory for several companies and have each companies info be separate from each other.

  44. kutchstir says:

    thank you for sharing these great help!

  45. Eric Kim says:

    ITFreeTraining rocks ! – you bring out everything about AD to life. I am supplementing my reading with your videos and I can't tell you how much it's all sinking in.
    You are doing a phenomenal job 🙂

  46. Pete Flores says:

    thank you for this excellent information.

  47. Technology Freakz says:

    Thank you so much sir!! Very clear explanation!! God Bless..

  48. Ashutosh Gupta says:

    Very helpful in understanding basic concepts of AD

  49. IamAnoobiecheez says:

    Thank you for the training.

  50. Prokure says:

    FYI, Domain and sub domains are NOT the same.

  51. AungKK says:

    Very clear explanation! Thank you, i am revising this for exam

  52. Arvind Shetty says:

    The best explanation about Forests, Trees and Domains that I have seen so far!!!!

  53. Aravindasamy PalaniSamy says:

    Can anyone explain about forest?

  54. Jack Jensen says:

    Great explanation

  55. Linz Mathew says:

    Well explained

  56. Sawsan Slii says:


  57. Uttam Singh says:

    i love the way you explain….

  58. danieliko3 says:

    Didn't understand the concept until this video. Thanks!

  59. anderato says:

    have seen some videos in order to clearly understand the concept, this one is by far that made it crystal clear, great video.

  60. Srikesh Maharaj says:

    Wow! Perfect Explanation…. Thank you!

  61. Jasam Ahamed says:

    how to know the forest name if a forest have multiple tree domains ? any command or steps in windows server 2003

  62. Nuas F. Al Shareefi says:

    Informative and helpful, Many Thanks !

  63. leo says:

    outstanding job.

  64. Silvio Lucas says:

    Vídeo perfeito! Perfect video! Congrats!

  65. venki145 says:

    Here's our scenario and i need your help. Our cognos BI environment uses AD for authentication. we have one namespace in our BI. Now our company 'A' acquired another company 'B' which has its own AD, users and groups. To integrate, I configured another namespace for company 'B' users in our Cognos BI so they can have access to our resources and we have created new groups in our AD and added users from other AD to access our resources. But the 'B' users can't access our contents. Our Cognos BI is not recognizing the Company 'B' users in the newly created groups in 'A' AD. If I add the 'B' users directly from 'B' namespace then they can access. In our cognos BI configuration, we have added "MultiDomainTrees' = 'TRUE'. Still no luck . Are we missing something on AD side? Any suggestions or help please?

  66. Fraydun Fariad says:

    Should read "Domain, Tree, Forest" instead of "Domain, Forest, Tree" – much easier to understand.

  67. james bond says:

    i dont understand how schema is the reason for the need of having a forest.Can you explain?

  68. Anand Pandey says:

    In this video, how would domain is a part of forest? Because all domain in single forest share same namespace, In above scenario there are 3 forest not two please clarify.

  69. sandeep kumar says:

    Hello Sir, can you please tell me that how many domain can be created per tree and how many tree can be created per forest ?

  70. Shehab White says:

    Thank You

  71. Abhishek Bhardwaj says:

    I have been trying to understand this forest and tree concept from last one year but failed to understand. With your trainung clip it was very easy and quick…..thnx

  72. TuroMisu says:

    Just here to say… Thank You!

  73. Sanskar Singh says:


  74. Vincent Irudayaraj says:

    Very clear explanation

  75. Sujesh K says:

    First of all I want to thank you so much for the amazing explanation…Clear and Crisp way of explanation one can find about active directory forests and trees…helped me to understand the concept in a clear cut way, which I have been searching from past few months..subscribed and liked.. once again thanks a lot !!

  76. Rajeev Kumar says:

    Thanks sir for providing such a great information. Sir I have a question I have seen somewhere they were explaining in a forest two different domain has their own schema they don't share. I am confused now.

  77. Joe Crow says:

    Thank you

  78. kledder says:

    05:46 If by domain you mean tree than yes. Then the root domain is GCS by default. But not every DC is a GCS by default. You can tick that box when you're installing AD DS (Active Directory Domain Services).

  79. Jones Paul says:


  80. meir says:

    Best AD DS videos in youtube!

  81. Bradley-Keith [Brusenhan] says:

    Tks for the IP info…

  82. Christian Joseph Gutib says:

    Thank you for the great work of yours! You helped a lot on these set of videos. I wish you can create more for windows server 2016 and Windows Server 2019. Kudos!

  83. Michael Bacani says:


  84. vvv vvv says:

    Very well presented. Clear to understand.

  85. Rajnandini Ranbhare says:

    Thank you for this video. Can you please provide tutorial/links mentioning ways to search active directory forest using global catalog, using JNDI/LDP client etc? It will be really helpful

  86. HassanTech20 says:

    Thanks a lot. Clear and condense explanation.

  87. M.H Tech U.K says:

    Thank you for the video

  88. Nilay Bhoraskar says:

    Excellent video and nothing has been changed until now. Though the GUI might have changed but the explanation which he has provided is awesome.

  89. Rishad vlogs says:

    watching in 2019 this video was made 7 yrs ago. still usefull

  90. Simba Durio says:

    Very nicely done!

  91. Brad Peters says:

    Very clear explanation of the material.

  92. Rajesh Babu says:

    I did something productive today. A great video with good explanation.

  93. Omar says:

    Omg thanks i was so lost before this video!!!

  94. Joe Killeen says:

    Loved this video! Thank you

  95. PCPMTI Serviços says:

    Great video mate, thank you very much

  96. Hay Mizrachi says:

    Very good explanation. very useful course, Thanks!

  97. Adrian says:

    This really helped a lot understanding trees and forests! thank you!

  98. Hot CakeX says:

    i love the way you explain. so easy to understand, specially with the illustrations. thank you!

  99. steve randall says:

    Absolutely Bloody Excellent. This has got to be THE best explanation of AD Forest and trees that I have EVER come across. Wow, did I fully understand this. Thanks a million itfreetraining.

  100. Tahir Mirza says:

    Beautiful explanation 👍🏽up from the heart.

Leave a Reply

Your email address will not be published. Required fields are marked *