Windows 2000 Components Domains provide a primary partition and sort of master container. Organizational Units do not represent a literal partition, but are included in the LDAP namespace and serve as partitions for administration. Active Directory namespace components include the forest and tree domain structure, and organizational units. Active Directory is the domain. ACEs can be inherited from parent containers defined within the domain.
Administrative rights are limited to domain boundaries by default.
Multiple domains within the Active Directory are linked to a domain tree. Users in these linked domains can access resources in other domains via transitive trust relationships that exist hierarchically among all of the domains in the domain tree. However, administrative rights are not inherently transitive. Thus, an additional layer of security is added by limiting the scope of domain administrative rights. The DIT provides an intuitive perspective of the objects, containers, and resources contained within the directory.