All objects in a tree share a common DNS namespace. Unlike Windows NT's domains, Active Directory can further subdivide domains into organizational units that contain other units or leaf objects, such as users, printers, and so on.
Trusts give user and group rights to traverse domains and are essential for single sign-on.
We were also pleased to find that Active Directory lets the administrator delegate administrative authority down to the Organizational Unit level, as opposed to Windows NT 4, which could only delegate to the domain level. So you can set more restrictive access to your human resources department Organizational Unit or domain than to the sales Organizational Unit or domain, for example. Administrative rights do not cross domain boundaries, but rights granted to one Organizational Unit in the domain hierarchy can be inherited by all subordinate Organizational Units of the tree. In contrast to NDS, user rights to other domain objects or common resources such as file servers cannot be assigned to an Organizational Unit. Rights must always be configured for individual users and groups.