Active Directory Domains, Trees, and Forests

AD’s logical structure nests: organizational units inside domains, domains inside trees, trees inside a forest. Getting the vocabulary right matters because the boundaries imply very different security properties.

• Domain — a partition of the directory and the unit of replication policy (password policy, account database). Every domain controller holds a full read/write copy of its own domain’s NTDS.dit.
• Tree — a set of domains sharing a contiguous DNS namespace (corp.example.com, sales.corp.example.com). Parent/child domains in a tree are auto-linked by two-way transitive trusts.
• Forest — the top-level container: one or more trees that share a common schema, configuration partition, and global catalog, but not necessarily a DNS namespace (example.com and contoso.com can live in one forest). The first domain created becomes the forest root domain; it holds the forest-wide privileged groups (Enterprise Admins, Schema Admins) and acts as an invisible anchor — every domain in the forest has an automatic transitive trust path to it.

The security consequence everyone relearns the hard way: the forest, not the domain, is the real security boundary. Because every domain in a forest is joined by transitive two-way trusts with no SID filtering between them, compromising any child domain lets an attacker forge ExtraSids for Enterprise Admins and own the entire forest (see trust pivoting). Domains are administrative and replication partitions; they are not isolation walls.

Related

• active-directory-ous-and-containers — the next containment level down, inside a domain
• active-directory-trusts — trust types, direction, and transitivity
• active-directory-trust-pivoting — abusing intra-forest transitive trusts
• ntds-dit — the per-domain database each DC carries

Sources

• Understanding the Active Directory Logical Model
• How trust relationships work for forests in Active Directory