Lesson 2: Establishing the Root Domain

The root domain in Active Directory directory services is the top branch of the enterprise namespace. Other domains in the tree are subdomains below the root domain. All other domains refer to the root domain as the root of the enterprise. If you fail to plan and establish the root domain correctly, you can compromise your network structure from the beginning. For example, if you use the incorrect root name, all child domains will inherit this incorrect name as part of their name.

After you have planned your network upgrade, the first step in upgrading your network to Windows 2000 is to establish the root domain. There are two options for establishing the root domain:

• Migrate an existing Windows NT 4.0 domain to a Windows 2000 root domain.
• Create a new Windows 2000 root domain.

The option you use depends on the domain model you use in your existing Windows NT 4.0 network.

You upgrade an existing domain to serve as the new root domain when your existing Windows NT 4.0 network uses one of these two domain models:

• Single domain model
• Single master domain model

In these two models, user accounts and global groups are created in a single domain, called the master domain. In the single master domain model, only computer accounts and resources are created in the resource domains. The resource domains trust the master domain.

When you upgrade the master domain to Active Directory directory services first, it forms the root of a new domain tree. In the single master domain model, you then upgrade the resource domains to become child domains of the root domain.

The following objects migrate from Windows NT to Active Directory directory services during an upgrade:

• User accounts migrate to the users container.
• Computer accounts migrate to the computers container.
• Global groups migrate to the users container.
• Local groups migrate to the users container.
• Built-in groups migrate to the built-in container.
• Permissions for the NTFS file system files, printers, and local groups.

In Windows NT 4.0, administrators used domains to manage users and delegate administrative control. In Windows 2000, administrators use OUs to organize computers and users, delegate authority, and manage group policy.

Your OU structure can model your organizational, geopolitical, or administrative structure. Combine objects into a logical hierarchy of OUs that represent either of the following for your company:

• Organizational model. This model is based on departmental or geographical boundaries. For example, company A is organized into departments and has a research department, a development department, and a sales department. In this company, the administrators use different computer settings and deploy different applications for each department. You would create a Research OU, a Development OU, and a Sales OU, and you would place users and computers into these OUs as relevant. You would then use group policy to administer these settings and distribute applications.
• Administrative model. This model is based on which administrators are responsible for managing specific users and resources across the network. For example, company B uses separate IS managers for each location in the company. The IS managers in each location manage the users and computers in that location. You would create organizational units for each location and move the users and computers into these OUs. You would then delegate administrative control of those OUs to the appropriate IS managers.

To improve management and administration of users and computers in your company, examine your organizational structure, and then create OUs in the upgraded master domain to meet your business requirements.

You create a new root domain for your Windows 2000 network when your existing Windows NT 4.0 network uses one of the following two domain models:

• Multiple master domain model
• Complete trust model

With these models, more than one domain contains user accounts and global groups. Therefore, you must establish a new root domain, and then upgrade the master domains to be children of this new root domain.

You can also upgrade these domain models to a forest with multiple disjointed namespaces. However, this would only be a viable option in an organization with many separate companies that had little need for intercommunication.

The root domain in Active Directory directory services is the top branch of the enterprise namespace. All other domains in the tree are subdomains below the root domain and refer to the root domain as the root of the enterprise. If you fail to plan and establish the root domain correctly, you can compromise your network structure from the beginning.

After you have planned your network upgrade, the first step in upgrading your network to Windows 2000 is to establish the root domain. You can migrate an existing Windows NT 4.0 domain to a Windows 2000 root domain, or you can create a new Windows 2000 root domain. You upgrade an existing domain to serve as the new root domain when your existing Windows NT 4.0 network uses the single domain model or the single master domain model.

You create a new root domain for your Windows 2000 network when your existing Windows NT 4.0 network uses either the multiple master domain model or the complete trust model. With these models, more than one domain contains user accounts and global groups. Therefore, you must establish a new root domain, and then upgrade the master domains to be children of this new root domain.