Identity resilience glossary
Active Directory forest
An Active Directory forest is the top-level structure in Active Directory Domain Services, containing one or more domains. Its domains share a schema, configuration information, and a global catalog, with automatic two-way, transitive trusts between them. A forest is also a security boundary, which makes it an important unit for identity administration and recovery planning.
How a forest is organized
Domains divide the directory into partitions, and organizational units organize objects within each domain. The shared schema defines the types of objects and attributes the directory can contain. The global catalog supports searches across the forest. These are logical relationships: a forest's structure is not defined by the number of servers, offices, or datacenters an organization has.
The first domain created is the forest root domain. Adding another domain within that forest does not create an independent forest.
Why the security boundary matters
Separate domains can support different administrative needs, but domains within one forest should not be treated as completely independent security environments. They participate in shared forest infrastructure and trust relationships. Teams need to distinguish delegated responsibility inside a forest from a requirement for a separate security boundary when they design identity controls.
Example: two domains, one forest
Imagine an organization with separate domains for its European and North American operations inside one forest. Regional teams manage their own user accounts, while both domains use the forest's shared schema. A proposed schema change therefore needs a forest-wide impact review. The administrative separation between the regions does not make that shared change regional.
What to document for recovery planning
A useful forest inventory identifies the domains, forest root, shared services, and administrative ownership. It should distinguish forest-wide configuration from domain-specific data. This gives teams a clearer starting point for deciding whether an incident concerns one object, one domain, or the wider forest. Counting domain controllers alone does not describe those relationships.