Re: Active Domain Architecture in an Academic Environment

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Tue, 28 Sep 2010 17:42:47 EDT, Dexter Caldwell said:

> There are a very few things that you'd need a separate forest for per se.

> It doesn't mean it would be the wrong choice, but you have a lot of means
> of managing security, roles and groups within a simpler design that may
> more than suffice.

When we set up our main forest many many moons ago, one organization in the
university went to go create their own forest due to mostly political concerns
("We're going to do our own because Central IT can't possibly do it right, for
*our* definition of right").  This was expected, because the attitude had been
there for at least a decade before.

What we did *not* expect was that the same political considerations that
resulted in the creation of multiple forests also made it impossible to agree
on rules of engagement to allow cross-forest trust relationships.

The problem was eventually resolved, but (somewhat predictably) involved the
retirement of multiple high-level people on both sides of the issue.

Attachment: _bin
Description: