Active Directory is the domain. All network objects exist within a domain. Within a domain, access permissions are cumulative unless explicitly denied. Administrative rights are limited to domain boundaries by default. Domains represent a logical partition within the Active Directory for both security and directory replication, and relate directly to the DNS namespace.
Domains provide a boundary for security and a scope for the replication of Domain NCs.
The domain administrator has absolute rights to set policies only within that domain. Theoretically, a domain directory can contain up to 10 million objects. As group policy will not inherit across domain boundaries, domains also provide scope for policy. While domains do not have the restrictions and impact experienced in a Windows NT 4 environment, the particular use of domains can be derived from their function. With regard to the latter, domains are often scoped to geographic boundaries to provide network optimization.