In some situations it is therefore sensible to locate root DCs close to clients. If you use an empty root domain unnecessary account replication will not need to take place. Domain Administrator logins. Permissions on the root forest should be split for security's sake. You can set permissions by ACLs, but be aware that Domain Admins in the root domain can make themselves members of the Enterprise Admins group by default which can then be used to gain administrator access to every machine in the forest.
Password policy is domain specific.
You can apply more secure policies regarding passwords etc. Because the empty root domain is small, it can be easily replicated anywhere on the network to protect against location-based disasters. Back to Top Copyright 2001 Tony Murray. All rights reserved. All rights reserved.