Is there ordering priority to configure ADDS forest and operation masters roles?

Question

A. Is there ordering priority to configure ADDS forest and operation masters roles?

assume I have two forest domain, each forest domain have child domain, the two parent domain use

below assignment of operation roles to seize roles,

B. should I configure two parent domain as below operation masters roles first or configure ADDS forest including child domain first ?

C. how to configure resource forest and restricted access forest?

D. Are File servers , Exchange servers, SQL servers , application type servers put in resources forest?

E. what is the difference between resources forest and child forest?

Answer 1

Hello 2AI,

Thank you for posting in Microsoft Community forum.

A. Is there ordering priority to configure ADDS forest and operation masters roles?

A1: No.

assume I have two forest domain, each forest domain have child domain, the two parent domain use

below assignment of operation roles to seize roles,

B. should I configure two parent domain as below operation masters roles first or configure ADDS forest including child domain first ?

A2: You can set up forest root domain and then set up child domain.

C. how to configure resource forest and restricted access forest?

A3: You can read link below.
Forest Design Models | Microsoft Learn

Create two different forests, and set up trust between the two forests, only "resource forest" trusts "restricted access forest".

D. Are File servers , Exchange servers, SQL servers , application type servers put in resources forest?

A4: Yes, I think so.

E. what is the difference between resources forest and child forest?

A5: From link above, I can see:
In the resource forest model, a separate forest is used to manage resources. Resource forests do not contain user accounts other than those required for service administration and those required to provide alternate access to the resources in that forest, if the user accounts in the organizational forest become unavailable. Forest trusts are established so that users from other forests can access the resources contained in the resource forest.

What did you mean child forest? Do you mean child forest is restricted access forest? If so,
in the restricted access forest model, a separate forest is created to contain user accounts and data that must be isolated from the rest of the organization. Restricted access forests provide data isolation in situations where the consequences of compromising project data are severe.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

should CA servers put in resources forest or organization parent forest ?

Answer 3

Hello 2AI,

Good day!

AD CS (CA server) is a service, I think you should put it in resources forest.

Best Regards,
Daisy Zhou

Answer 4

1. how do I know and confirm client use read only domain controller to login active directory?
2. If previous question using at least 8 VM to use forest model, add 3 read only domain controller to parent organization forest, restricted access forest and resource forest respectively? then need 11 VM to use forest model?

Answer 5

Should DHCP servers be placed at resources forest ?