Place holder root domain advantage

[shyman]

I am having difficulties with a domain design to select. I always saw that it is best practice design to create an empty place holder root domain to hold the enterprise admin group and to hold the forest schema operations role. After that have another domain to hold all users/groups/computers. The alternative being one domain, that holds all of the above. There does seems to be additional hardware costs associated with the empty place holder domain, but there isnt going to be much admin overhead since the domain is going to be basically unused. Whats the reason for the place holder root domain is setup and should this domain design be favored in a large enterprise organization vs the single domain model? Thanks.

[Anywhere]

You have told about the basic reasons, a place holder for the tree that is offering a contiguous namespace, as well as hiding the EA and Schema Admins. In the past, back in the early 2000 days, it was the basic thinking to use an empty root. But the design mentality of an empty root has changed with increased features and changes in 2003 security, or basically because of budget. So the most common designs are simply one domain unless you need across the business partner migrated domains in a decentralized delegation.

[melry88]

Everyone,

I just wanted to add that this is still a highly recommended path from Microsoft. I read above in other posts that it was not so I started to read the Windows 2008 AD Resource Kit. The resource kits states that if you are using a forest with multiple domains that it is "strongly" recommended to also use an empty root. This is listed on page 215 under "Best Practices".

I am not trying to start a flaming war, but I wanted to make sure other readers fully understand Microsoft's approach to this.

Thanks....