“
There are a number of restrictions that you have to be aware of when beginning your Active Directory design. We will introduce you to them in context as we go along, but here are some important ones: The forest, not the domain, is the security boundary for Active Directory. Anyone with high-level access rights on any writable domain controller in any domain can negatively impact or take control of any other DC or domain in the forest. You can never remove the forest root domain without destroying the whole forest in the process. The forest root domain is the cornerstone of your forest. Multiple domains cannot be hosted on a single DC. Imagine three child domains under a root domain located in the United States, each of which corresponds to one of three business units. Now imagine that you have a small office of 15 people in Eastern Europe or Latin America with a slow link to the US offices. These 15 users are made up of three sets of 5; each set of 5 users belongs to one of the three business units/domains. If you decide that the intersite link is too slow and you would like to install a local domain controller for these three domains at the remote site, you will need to install and support three separate domain controllers, one for each domain. While this could be virtualized, that is still three additional domain controllers to manage, update, and monitor. Too many group policy objects (GPOs) often leads to long logon times, as the group policies are applied to sites, domains, and organizational units. This obviously has a bearing on your organizational unit structure, as a 10-deep organizational unit tree with GPOs applying at each branch will incur more GPO processing than a 5-deep organizational unit tree with GPOs at each branch. However, if the 10-deep and 5-deep OU structures both contained only two levels with GPOs, they would both incur the same GPO processing.
”
”
Alistair G. Lowe-Norris (Active Directory: Designing, Deploying, and Running Active Directory)