选择林根域Selecting the Forest Root Domain

适用于:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

在 Active Directory 林中部署的第一个域称为林根域。The first domain that you deploy in an Active Directory forest is called the forest root domain. 在 AD DS 部署的生命周期中,此域仍是目录林根级域。This domain remains the forest root domain for the life cycle of the AD DS deployment.

目录林根级域包含 Enterprise Admins 和 Schema Admins 组。The forest root domain contains the Enterprise Admins and Schema Admins groups. 这些服务管理员组用于管理林级操作,例如添加和删除域以及实现架构更改。These service administrator groups are used to manage forest-level operations such as the addition and removal of domains and the implementation of changes to the schema.

选择目录林根级域涉及确定域设计中 Active Directory 域之一是否可以充当目录林根级域,或者是否需要部署专用林根域。Selecting the forest root domain involves determining if one of the Active Directory domains in your domain design can function as the forest root domain or if you need to deploy a dedicated forest root domain.

有关部署目录林根级域的信息,请参阅 部署 Windows Server 2008 林根域For information about deploying a forest root domain, see Deploying a Windows Server 2008 Forest Root Domain.

选择区域或专用林根域Choosing a regional or dedicated forest root domain

如果要应用单个域模型,则单一域将充当目录林根级域。If you are applying a single domain model, the single domain functions as the forest root domain. 如果你正在应用多个域模型,则可以选择部署专用林根域,或选择一个区域域作为目录林根级域。If you are applying a multiple domain model, you can choose to deploy a dedicated forest root domain or select a regional domain to function as the forest root domain.

专用林根级域Dedicated forest root domain

专用目录林根级域是专门创建的域,用作林根。A dedicated forest root domain is a domain that is created specifically to function as the forest root. 它不包含目录林根级域的服务管理员帐户以外的任何用户帐户。It does not contain any user accounts other than the service administrator accounts for the forest root domain. 此外,它不表示域结构中的任何地理区域。Also, it does not represent any geographical region in your domain structure. 林中的所有其他域都是专用林根域的子域。All other domains in the forest are children of the dedicated forest root domain.

使用专用林根具有以下优势:Using a dedicated forest root provides the following advantages:

  • 域服务管理员对林服务管理员的操作分离。Operational separation of forest service administrators from domain service administrators. 在单一域环境中,Domain Admins 组和内置管理员组的成员可以使用标准工具和过程自行成为企业管理员和架构管理员组的成员。In a single domain environment, members of the Domain Admins and built-in Administrators groups can use standard tools and procedures to make themselves members of the Enterprise Admins and Schema Admins groups. 在使用专用目录林根级域的林中,Domain Admins 和 Domain Admins 组的成员不能通过使用标准工具和过程,使其成为林级别服务管理员组的成员。In a forest that uses a dedicated forest root domain, members of the Domain Admins and built-in Administrators groups in the regional domains cannot make themselves members of the forest-level service administrator groups by using standard tools and procedures.
  • 防止其他域中的操作更改。Protection from operational changes in other domains. 专用林根域不表示域结构中的特定地理区域。A dedicated forest root domain does not represent a particular geographical region in your domain structure. 出于此原因,它不受重组或其他导致重命名或重新构建域的更改的影响。For this reason, it is not affected by reorganizations or other changes that result in the renaming or restructuring of domains.
  • 用作非特定根,因此不会显示任何国家或地区。Serves as a neutral root so that no country or region appears to be subordinate to another region. 某些组织可能希望避免一个国家或地区隶属于命名空间中的另一个国家或地区的外观。Some organizations might prefer to avoid the appearance that one country or region is subordinate to another country or region in the namespace. 使用专用目录林根级域时,所有区域域都可以是域层次结构中的对等。When you use a dedicated forest root domain, all regional domains can be peers in the domain hierarchy.

在使用专用林根的多区域域环境中,林根域的复制对网络基础结构的影响最小。In a multiple-regional-domain environment in which a dedicated forest root is used, the replication of the forest root domain has minimal impact on the network infrastructure. 这是因为林根只承载服务管理员帐户。This is because the forest root only hosts the service administrator accounts. 林中的大部分用户帐户以及其他特定于域的数据存储在区域中。The majority of the user accounts in the forest and other domain-specific data are stored in the regional domains.

使用专用林根域的一个缺点是它会产生额外的管理开销,以支持其他域。One disadvantage to using a dedicated forest root domain is that it creates additional management overhead to support the additional domain.

作为林根域的区域域Regional domain as a forest root domain

如果选择不部署专用林根域,则必须选择一个区域域作为林根域。If you choose not to deploy a dedicated forest root domain, you must select a regional domain to function as the forest root domain. 此域是所有其他地区性域的父域,将是你部署的第一个域。This domain is the parent domain of all of the other regional domains and will be the first domain that you deploy. 目录林根级域包含用户帐户,其管理方式与管理其他区域域的方式相同。The forest root domain contains user accounts and is managed in the same way that the other regional domains are managed. 主要区别在于它还包括 Enterprise Admins 和 Schema Admins 组。The primary difference is that it also includes the Enterprise Admins and Schema Admins groups.

选择区域域作为目录林根级域的优点在于,它不会创建维护附加域的额外管理开销。The advantage of selecting a regional domain to function as the forest root domain is that it does not create the additional management overhead that maintaining an additional domain creates. 选择适当的区域域作为林根节点,例如代表您的总部的域或网络连接速度最快的区域。Select an appropriate regional domain to be the forest root, such as the domain that represents your headquarters or the region that has the fastest network connections. 如果你的组织很难选择一个区域域作为目录林根级域,则可以改为选择使用专用林根模型。If it is difficult for your organization to select a regional domain to be the forest root domain, you can choose to use a dedicated forest root model instead.

分配目录林根域名Assigning the forest root domain name

林根域名也是林的名称。The forest root domain name is also the name of the forest. 林根名称是域名系统 (DNS) 名,该名称由前缀和后缀格式的后缀组成。The forest root name is a Domain Name System (DNS) name that consists of a prefix and a suffix in the form of prefix.suffix. 例如,组织可能将林根名称设置为 corp.contoso.com。For example, an organization might have the forest root name corp.contoso.com. 在此示例中,corp 是前缀,contoso.com 是后缀。In this example, corp is the prefix and contoso.com is the suffix.

从网络上的现有名称列表中选择 "后缀"。Select the suffix from a list of existing names on your network. 对于前缀,请选择以前未在网络上使用的新名称。For the prefix, select a new name that has not been used on your network previously. 通过将新前缀附加到现有后缀,可以创建唯一的命名空间。By attaching a new prefix to an existing suffix, you create a unique namespace. 为 Active Directory 域服务 () AD DS 创建新的命名空间,可确保无需修改任何现有的 DNS 基础结构即可容纳 AD DS。Creating a new namespace for Active Directory Domain Services (AD DS) ensures that any existing DNS infrastructure does not need to be modified to accommodate AD DS.

选择后缀Selecting a suffix

选择目录林根级域的后缀:To select a suffix for the forest root domain:

  1. 请联系组织的 DNS 所有者,以获取将承载 AD DS 的网络中使用的已注册 DNS 后缀列表。Contact the DNS owner for the organization for a list of registered DNS suffixes that are in use on the network that will host AD DS. 请注意,在内部网络上使用的后缀可能不同于在外部使用的后缀。Note that the suffixes used on the internal network might be different than the suffixes used externally. 例如,组织可能会在 Internet 上使用 contosopharma.com,并在内部公司网络中使用 contoso.com。For example, an organization might use contosopharma.com on the Internet and contoso.com on the internal corporate network.

  2. 请参阅 DNS 所有者,以选择与 AD DS 一起使用的后缀。Consult the DNS owner to select a suffix for use with AD DS. 如果不存在适当的后缀,请使用 Internet 命名机构注册一个新名称。If no suitable suffixes exist, register a new name with an Internet naming authority.

建议你使用在 Active Directory 命名空间中向 Internet 颁发机构注册的 DNS 名称。We recommend that you use DNS names that are registered with an Internet authority in the Active Directory namespace. 只有注册的名称才能保证是全局唯一的。Only registered names are guaranteed to be globally unique. 如果其他组织稍后注册了相同的 DNS 域名 (或者,如果你的组织与使用相同 DNS 名称) 的另一家公司进行合并、获取或获取,则这两个基础结构无法相互交互。If another organization later registers the same DNS domain name (or if your organization merges with, acquires, or is acquired by another company that uses the same DNS name), the two infrastructures cannot interact with one another.

注意

不要使用单标签 DNS 名称。Do not use single-label DNS names. 有关详细信息,请参阅 使用单标签 DNS 名称配置的 Active Directory 域的部署和操作For more information, see Deployment and operation of Active Directory domains that are configured by using single-label DNS names. 此外,我们不建议使用未注册的后缀,如 local。Also, we do not recommend using unregistered suffixes, such as .local .

选择前缀Selecting a prefix

如果选择了已在网络上使用的已注册后缀,请使用下表中的前缀规则为林根域名选择前缀。If you chose a registered suffix that is already in use on the network, select a prefix for the forest root domain name by using the prefix rules in the table below. 添加当前未用于创建新的从属名称的前缀。Add a prefix that is not currently in use to create a new subordinate name. 例如,如果 DNS 根名称是 contoso.com,则可以在网络上未使用命名空间 concorp.contoso.com 时,创建 Active Directory 林根域名 concorp.contoso.com。For example, if your DNS root name is contoso.com, you can create the Active Directory forest root domain name concorp.contoso.com if the namespace concorp.contoso.com is not already in use on the network. 命名空间的新分支将专门用于 AD DS,并可与现有的 DNS 实现轻松集成。This new branch of the namespace will be dedicated to AD DS and can be integrated easily with the existing DNS implementation.

如果选择了一个区域域作为目录林根级域,则可能需要为域选择新的前缀。If you selected a regional domain to function as a forest root domain, you might need to select a new prefix for the domain. 因为林根域名会影响林中的所有其他域名,所以,基于突破的名称可能不合适。Because the forest root domain name affects all of the other domain names in the forest, a regionally based name might not be appropriate. 如果你使用的是当前未在网络中使用的新后缀,则可以将其用作林根域名,而无需选择其他前缀。If you are using a new suffix that is not currently in use on the network, you can use it as the forest root domain name without choosing an additional prefix.

下表列出了为已注册的 DNS 名称选择前缀的规则。The following table lists the rules for selecting a prefix for a registered DNS name.

规则Rule 说明Explanation
选择不可能过时的前缀。Select a prefix that is not likely to become outdated. 避免将来可能会更改的名称,如产品线或操作系统。Avoid names such as a product line or operating system that might change in the future. 建议使用一般名称,如 corp 或 ds。We recommend using generic names such as corp or ds.
选择仅包含 Internet 标准字符的前缀。Select a prefix that includes Internet standard characters only. A-z、a-z、0-9 和 ( ) ,但并不完全是数字。A-Z, a-z, 0-9, and (-), but not entirely numerical.
前缀中包含15个或更少的字符。Include 15 characters or less in the prefix. 如果选择的前缀长度不超过15个字符,则 NetBIOS 名称与前缀相同。If you choose a prefix length of 15 characters or less, the NetBIOS name is the same as the prefix.

Active Directory DNS 所有者与组织的 DNS 所有者合作,以获取将用于 Active Directory 命名空间的名称的所有权,这一点非常重要。It is important for the Active Directory DNS owner to work with the DNS owner for the organization to obtain ownership of the name that will be used for the Active Directory namespace. 有关设计 DNS 基础结构以支持 AD DS 的详细信息,请参阅 创建 Dns 基础结构设计For more information about designing a DNS infrastructure to support AD DS, see Creating a DNS Infrastructure Design.

记录目录林根域名Documenting the forest root domain name

记录为林根域选择的 DNS 前缀和后缀。Document the DNS prefix and suffix that you select for the forest root domain. 此时,确定哪个域将成为林根。At this point, identify what domain will be the forest root. 您可以将目录林根域名信息添加到您创建的 "域计划" 工作表中,以便记录新域和升级域的计划以及域名。You can add the forest root domain name information to the "Domain Planning" worksheet that you created to document your plan for new and upgraded domains and your domain names. 若要打开它,请从 适用于 Windows Server 2003 部署工具包的作业助手 下载 Job_Aids_Designing_and_Deploying_Directory_and_Security_Services.zip,并 ( # A1) 打开 "域计划"。To open it, download Job_Aids_Designing_and_Deploying_Directory_and_Security_Services.zip from Job Aids for Windows Server 2003 Deployment Kit and open "Domain Planning" (DSSLOGI_5.doc).