Explain the logical structure of Active Directory, including domains, trees, forests, and organizational units. How do they relate to each other?

Question

Accepted Answer

Active Directory organizes network resources into a hierarchical logical structure that allows administrators to manage users, computers, and services efficiently. Understanding this structure is fundamental for any L2 technician working in a Windows enterprise environment, because the way objects are organized determines how policies are applied, how authentication works, and how administrative responsibilities are delegated.

A domain is the core building block of Active Directory. It is a logical grouping of objects, including user accounts, computer accounts, groups, and shared resources, that share a common directory database and a set of security policies. Every object within a domain is stored in the Active Directory database on domain controllers, which are servers that authenticate users and enforce policies. A domain establishes a security boundary, meaning that administrators in one domain do not automatically have access to resources in another domain. Domains are identified by their DNS names, such as corp.company.com.

An Organizational Unit, or OU, is a container within a domain used to organize objects into logical groups. OUs are not security boundaries; they are administrative boundaries. Their primary purposes are twofold. First, they allow administrators to apply Group Policy Objects to a specific subset of users or computers. For example, you might have an OU called "Finance" with all finance department users, and you apply a GPO that restricts access to certain applications only to that OU. Second, OUs enable delegation of control, which means you can grant a team lead or department IT contact the ability to reset passwords or manage accounts within their OU without giving them access to the entire domain.

A tree is a collection of one or more domains that share a contiguous namespace. The root domain is at the top, and child domains branch off below it. For example, corp.company.com might have child domains like us.corp.company.com and eu.corp.company.com. All domains in a tree automatically trust each other through transitive trust relationships, which means users in one domain can access resources in another domain within the same tree, provided they have the appropriate permissions.

A forest is the highest level of the Active Directory hierarchy. It is a collection of one or more trees that share a common schema, global catalog, and configuration partition, but do not share a contiguous namespace. A forest establishes the ultimate security boundary in Active Directory. Trust relationships can exist between forests, but they must be explicitly created and configured. Most small to mid-sized organizations operate within a single forest with a single domain, while large enterprises may have multiple domains and sometimes multiple forests.

The Global Catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain within the forest. When a user searches for a resource across the entire organization, the query goes to a Global Catalog server, which can locate the object regardless of which domain it belongs to. Without the Global Catalog, cross-domain searches would require querying every domain controller in every domain individually.

As an L2 technician, you will primarily work within a single domain, managing user accounts, computer objects, and group memberships through Active Directory Users and Computers. Understanding the broader structure helps you recognize why certain operations require elevated permissions and why some changes take time to replicate across the environment.