See domain controller , backup domain controller . For each object class, the schema defines what attributes an instance of the class must have, what additional attributes it may have, and what object class can be a parent of the current object base. See also object , attribute . At any time, there can be only one schema master in the forest. When a domain joins an existing forest or domain tree, a transitive trust is automatically established.
Transitive trusts are always two-way relationships.
This series of trusts, between parent and child domains in a domain tree and between root domains of domain trees in a forest, allows all domains in a forest to trust each other for the purposes of authentication. C. See also tree , forest . See also schema , forest . Universal groups can appear in ACLs anywhere in the forest, and can contain other universal groups, global groups, and users from anywhere in the forest. Small installations can use universal groups exclusively and not concern themselves with global and local groups.