The importance of such control is evident, since users moving between divisions, hence OUs or domains, will require a reorientation within the OU structures and associated services. Administration should also always be possible from a higher level, which would be difficult in disjointed OU structures. Active Directory is the domain. All network objects exist within a domain. Within a domain, access permissions are cumulative unless explicitly denied.
Administrative rights are limited to domain boundaries by default.
Domains represent a logical partition within the Active Directory for both security and directory replication, and relate directly to the DNS namespace. Domains provide a boundary for security and a scope for the replication of Domain NCs. The domain administrator has absolute rights to set policies only within that domain. Theoretically, a domain directory can contain up to 10 million objects. As group policy will not inherit across domain boundaries, domains also provide scope for policy.