Active Directory Forest: More Than Domain Trees

Clarifying the Definition

In Microsoft Active Directory, a forest is the top-level container. It comprises:

• One or more domain trees (each a hierarchical collection of domains sharing a contiguous namespace).
• Child domains within those trees.
• Domain controllers that replicate data across the forest via multi-master replication.

Key Characteristics

• Shared schema, configuration, and global catalog.
• Transitive trust relationships between all domains.
• Security boundary—objects cannot move between forests without migration tools.

Why "Not Just Domain Trees" Matters

A forest includes the replication topology, trust fabric, and enterprise-wide services (e.g., Exchange, Azure AD Connect) that operate across tree boundaries. Reducing it to "a group of domain trees" omits these critical systemic components.