For example, you can define a group policy that gives everyone access to Microsoft Word 2000 but restricts the use of Microsoft Access 2000 to managers only. Trees are groups of domains that share a contiguous DNS naming hierarchy, schema, configuration, and global catalog. It contains only a subset of the attributes for each object that it contains, and this subset is customizable by the administrator. A matter of trust Another important advantage of Windows 2000 over NT 4.0 is that the trust relationships between the domains within a tree are automatically two-way and transitive. The DC is responsible for the root of the DNS naming hierarchy.
Forests are groups of domain trees.
The difference between a forest and a tree is that a forest shares the same Active Directory schema directory configuration and replication information, but does not share a contiguous DNS domain naming hierarchy. Sites are more complicated and are used to manage the replication traffic and service requests within your organization. A site is defined as sets of computers on well-connected IP subnets. Sites allow you to tell Active Directory what your physical network looks like so that it can be utilized more efficiently. You can have multiple domains within a single site, and multiple sites within a single domain, depending on your physical network layout.