IAM Chapter 6, Part 4: The Shape of It

Part of the IAM study series.

Kerberos and LDAP both lean on this structure. Think of it as administrative geography: country, state, district.

1. Forest → Tree → Domain → OU

Level	Analogy	What it is
Forest	Country	One constitution, the schema; one passport system
Tree	Region	Domains sharing a namespace, like `skyline.local` and `eu.skyline.local`
Domain	State	Its own DCs, its own admins, its own password policy
OU	District	A subdivision for organising. No citizens of its own, no separate laws

Domains in a forest trust each other automatically. A forest trust is different: a treaty, explicit and limited.

2. Which Boundaries Are Real

	Own schema?	Own admins?	Own password policy?	Security boundary?
OU	No	Delegated only	No*	No
Domain	No, shared	Yes	Yes	No
Forest	Yes	Yes	Yes	Yes

* Except fine-grained password policies, which target groups, not OUs.

An OU is not a security boundary. "We'll put the contractors in their own OU so they're isolated" isolates nothing. An OU buys you two things: a place to attach Group Policy, and a scope to delegate administration.

A domain isn't one either. A Domain Admin in eu.skyline.local can escalate across the forest, because trust inside it is automatic. Microsoft's own position is that the forest is the security boundary. "We'll use a separate domain for the sensitive business" doesn't do what it sounds like. Schema changes also apply across the whole forest and can't be undone.

3. Where Is the Forest, Physically?

Nowhere, and everywhere. It's not a server. It's a set of relationships, recorded as data that every DC keeps an identical copy of. Each DC holds three partitions: schema (identical forest-wide), configuration (the map of forest, domains, sites, and replication links, also forest-wide), and domain (the actual users and computers, only on that domain's DCs). The tree is even less of a thing: it's implied by DNS naming.

The closest thing to a capital is the forest root domain, the first domain created, which holds the Schema Master and Domain Naming Master roles plus the Enterprise Admins and Schema Admins groups. A Global Catalog is a DC holding a partial copy of every object in every domain, listening on port 3268, so you can find any user anywhere.

4. Site: The Other Axis

A site represents a physical network location, defined by IP subnets. It has nothing to do with organisational structure. John's OU is the department he belongs to on paper; his site is the town he's standing in. If he travels to Hamburg, his site changes and his OU doesn't.

Sites do two jobs: control replication, so DCs replicate immediately in the same site and on a schedule between sites, and send clients to a nearby DC, so John's login doesn't cross a slow WAN link.

5. GPO: Why OUs Earn Their Keep

A GPO (Group Policy Object) is a bundle of settings applied automatically to users and computers, based on where they sit in the tree: screen lock timeouts, software deployment, firewall rules. You link it to a site, domain, or OU, and it applies to everything beneath. You can't link it to a group, only narrow it with security filtering.

Settings apply in LSDOU order: Local → Site → Domain → OU → nested OU. The last one wins, so the deepest OU takes precedence.

GPO is configuration management for machines and desktops, not an authorization model. Keep it separate from RBAC and ABAC, because "policy" is doing two very different jobs.

6. Five Things Called "Active Directory"

Product	What it is	A directory?
AD DS	The real thing: domains, forests, Kerberos, GPO, LDAP	Yes
AD LDS	LDAP directory with no domain: no Kerberos, no GPO	Yes
AD FS	A SAML / WS-Fed identity provider in front of AD DS	No
AD CS	A certificate authority	No
AD RMS	Protection travelling with the document	No

Entra ID isn't AD in the cloud. It's flat rather than a forest, grouped by administrative units, and speaks OIDC, OAuth, SAML, SCIM, and REST instead of LDAP and Kerberos. Entra Domain Services fills the gap with a managed AD DS for legacy apps.

Two patterns also sit around directories. A virtual directory presents several backends through one LDAP endpoint and translates at query time (fresh, but fails when a backend does). A meta-directory syncs them into a joined copy (survives outages, but can go stale). It's the same freshness-versus-availability trade as the PDP cache and the Kerberos ticket lifetime.

7. Why Run Two AD LDS Instances

A DMZ is a network segment between the internet and the internal network, where traffic into the LAN is tightly restricted. The partner portal needs to log people in, but there must be no route from the DMZ to a domain controller.

Skyline's answer runs one way: AD DS feeds a limited set of staff attributes to ADAM LAN, an AD LDS instance holding partners, customers, and app attributes. That pushes a thin subset out to ADAM DMZ, which is disposable and has no staff accounts.

The piece that makes it click is that ADAM LAN isn't a staging copy of AD DS. It holds people who could never have a domain account, and it's the master of them. Think of AD DS as the citizen register and the DMZ as a border post. Visitors aren't citizens, so the register has no entry for them, and you keep a separate visitor register inside and give the border post a copy.

Why not sync AD DS straight to the DMZ? The firewall rule is unacceptable, AD DS can't be filtered that finely, a stolen DMZ copy would hold your staff, and external users need write-back with validation. It's worth asking of any such setup: is this a master, a cache, or a hub?

Mistake	What goes wrong	Fix
OU treated as a security boundary	"Isolated" contractors aren't isolated	Separate forest if isolation is required
Separate domain for sensitive data	Trust inside the forest allows escalation	Separate forest with an explicit trust
Extending the schema for one app	Forest-wide, irreversible	AD LDS with its own schema
Sites undefined, or subnets unmapped	Laptops authenticate against a distant DC	Define sites and map every subnet
Deep nested OUs with clashing GPOs	Nobody can predict which setting wins	Flatten, and remember the deepest wins
DC or RODC placed in the DMZ	Whole domain's attack surface moves to the edge	AD LDS in the DMZ, fed one-way

🔴 CHECKPOINT: Study Notes

IAM Chapter 6 Part 4: The Shape of It, handwritten study notes on Active Directory forests, domains, OUs, sites and GPO

← Previous: The Sealed Ticket · Back to the series start · Next: LDAP →