選取 [樹系根網域Selecting the Forest Root Domain

適用於:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

部署 Active Directory 森林中的第一個網域稱為森林根網域。The first domain that you deploy in an Active Directory forest is called the forest root domain. 這個網域會保持生活循環 AD DS 部署的樹系根網域。This domain remains the forest root domain for the life cycle of the AD DS deployment.

森林根網域包含企業系統管理員和架構系統管理員 」 群組。The forest root domain contains the Enterprise Admins and Schema Admins groups. 這些服務的系統管理員群組用來管理森林層級作業,例如加入的網域和實作變更結構描述。These service administrator groups are used to manage forest-level operations such as the addition and removal of domains and the implementation of changes to the schema.

選取 [樹系根網域包括判斷是否 Active Directory 中的網域網域設計的其中一個可做的樹系根網域,或如果您要部署的專用的樹系根網域。Selecting the forest root domain involves determining if one of the Active Directory domains in your domain design can function as the forest root domain or if you need to deploy a dedicated forest root domain.

如部署根網域樹系資訊,請查看部署 Windows Server 2008 森林根網域For information about deploying a forest root domain, see Deploying a Windows Server 2008 Forest Root Domain.

選擇一個地區或專用森林根網域Choosing a regional or dedicated forest root domain

如果您要套用的單一網域模型,單一網域森林根網域功能。If you are applying a single domain model, the single domain functions as the forest root domain. 如果您要套用的多個網域模型,您可以選擇部署專用的樹系根網域,或選取要作為樹系根網域的地區網域。If you are applying a multiple domain model, you can choose to deploy a dedicated forest root domain or select a regional domain to function as the forest root domain.

專用的樹系根網域Dedicated forest root domain

作為樹系根專門建立網域專用的樹系根網域。A dedicated forest root domain is a domain that is created specifically to function as the forest root. 它不包含任何帳號以外的樹系根網域服務系統管理員帳號。It does not contain any user accounts other than the service administrator accounts for the forest root domain. 同時,不能代表您的網域結構在任何地理區域。Also, it does not represent any geographical region in your domain structure. 森林中的所有其他網域的專用的樹系根網域中的子女。All other domains in the forest are children of the dedicated forest root domain.

使用專用的樹系根提供下列優點:Using a dedicated forest root provides the following advantages:

  • 和網域服務系統管理員的樹系服務系統管理員運作分離。Operational separation of forest service administrators from domain service administrators. 在單一網域環境中,網域系統管理員 」 及建系統管理員群組成員可以使用標準工具和程序可讓企業系統管理員和架構管理員群組成員。In a single domain environment, members of the Domain Admins and built-in Administrators groups can use standard tools and procedures to make themselves members of the Enterprise Admins and Schema Admins groups. 樹系使用專用的樹系根網域網域系統管理員 」 及建地區網域中的系統管理員群組成員能本身的樹系層級服務的系統管理員群組成員使用標準工具和程序。In a forest that uses a dedicated forest root domain, members of the Domain Admins and built-in Administrators groups in the regional domains cannot make themselves members of the forest-level service administrator groups by using standard tools and procedures.

  • 保護電腦免於操作其他網域中的變更。Protection from operational changes in other domains. 專用的樹系根網域不能代表您的網域結構在特定地區。A dedicated forest root domain does not represent a particular geographical region in your domain structure. 基於這個原因,它不受企業或其他變更重新命名或重建的網域中的結果。For this reason, it is not affected by reorganizations or other changes that result in the renaming or restructuring of domains.

  • 做為中性根,才能讓任何國家或地區顯示為屬於另一個地區。Serves as a neutral root so that no country or region appears to be subordinate to another region. 某些組織可能會想要避免外觀該某個國家或地區都是屬於其他國家或地區命名空間。Some organizations might prefer to avoid the appearance that one country or region is subordinate to another country or region in the namespace. 當您使用專用的樹系根網域時,所有的地區網域可階層網域中的同事。When you use a dedicated forest root domain, all regional domains can be peers in the domain hierarchy.

在多重地區網域環境中使用的專用的樹系根的樹系根網域複寫有網路基礎結構的影響降到最低。In a multiple-regional-domain environment in which a dedicated forest root is used, the replication of the forest root domain has minimal impact on the network infrastructure. 這是因為樹系根只主控服務管理員帳號。This is because the forest root only hosts the service administrator accounts. 大部分的樹系和其他網域特定資料中帳號會儲存在區域的網域。The majority of the user accounts in the forest and other domain-specific data are stored in the regional domains.

使用專用的樹系根網域缺點是,它會建立支援其他網域其他管理成本。One disadvantage to using a dedicated forest root domain is that it creates additional management overhead to support the additional domain.

森林根網域地區的網域Regional domain as a forest root domain

如果您選擇不要部署專用的樹系根網域,您必須選取要作為樹系根網域的地區網域。If you choose not to deploy a dedicated forest root domain, you must select a regional domain to function as the forest root domain. 這個網域是家長網域其他地區網域中的所有,並將您要部署的第一個網域。This domain is the parent domain of all of the other regional domains and will be the first domain that you deploy. 森林根網域包含帳號,並在相同的方式,管理其他地區網域管理。The forest root domain contains user accounts and is managed in the same way that the other regional domains are managed. 主要不同的是,它也會包括企業系統管理員和架構系統管理員 」 群組。The primary difference is that it also includes the Enterprise Admins and Schema Admins groups.

建立現狀樹系根網域,它並不會建立管理額外費用的維護額外的網域選取地區網域函式的優點。The advantage of selecting a regional domain to function as the forest root domain is that it does not create the additional management overhead that maintaining an additional domain creates. 選取適當的地區網域將樹系根,例如,表示您總部網域或地區的最快速的網路連接。Select an appropriate regional domain to be the forest root, such as the domain that represents your headquarters or the region that has the fastest network connections. 如果很難以您的組織選取地區網域森林根網域,您可以選擇改為使用專用的樹系根模型。If it is difficult for your organization to select a regional domain to be the forest root domain, you can choose to use a dedicated forest root model instead.

指派森林根網域名稱Assigning the forest root domain name

森林根網域名稱還有樹系的名稱。The forest root domain name is also the name of the forest. 森林根名稱是包含前置詞與 prefix.suffix 的形式尾碼網域名稱系統 」 (DNS) 的名稱。The forest root name is a Domain Name System (DNS) name that consists of a prefix and a suffix in the form of prefix.suffix. 例如,的組織可能有森林根名稱 corp.contoso.com。For example, an organization might have the forest root name corp.contoso.com. 在此範例中,corp 前置詞,contoso.com 且尾碼。In this example, corp is the prefix and contoso.com is the suffix.

從您的網路名稱現有的清單中選取尾碼。Select the suffix from a list of existing names on your network. 選取前置詞未使用您的網路先前的新名稱。For the prefix, select a new name that has not been used on your network previously. 現有的尾碼附加新前置詞,您可以建立唯一命名空間。By attaching a new prefix to an existing suffix, you create a unique namespace. 建立新的命名空間 Active Directory Domain Services (AD DS) 可確保修改以符合 AD DS 不需要任何的現有 DNS 基礎結構。Creating a new namespace for Active Directory Domain Services (AD DS) ensures that any existing DNS infrastructure does not need to be modified to accommodate AD DS.

選取 [結尾Selecting a suffix

選取 [樹系根尾碼:To select a suffix for the forest root domain:

  1. 連絡 DNS 擁有者的清單中使用的網路裝載 AD DS,且已 DNS 尾碼組織。Contact the DNS owner for the organization for a list of registered DNS suffixes that are in use on the network that will host AD DS. 請注意,可能不同於尾碼使用外部尾碼連絡上使用。Note that the suffixes used on the internal network might be different than the suffixes used externally. 例如,組織可能會使用 contosopharma.com 網際網路上企業連絡 contoso.com 上。For example, an organization might use contosopharma.com on the Internet and contoso.com on the internal corporate network.

  2. 請選取使用的 AD DS 尾碼 DNS 擁有者。Consult the DNS owner to select a suffix for use with AD DS. 如果不適合尾碼存在,請登記名稱與網際網路命名授權單位。If no suitable suffixes exist, register a new name with an Internet naming authority.

我們建議您使用的 Active Directory 命名空間網際網路授權單位登記的 DNS 名稱。We recommend that you use DNS names that are registered with an Internet authority in the Active Directory namespace. 只有且已的名稱全域唯一保證。Only registered names are guaranteed to be globally unique. 如果稍後另一個組織暫存器相同 DNS 網域名稱 (或者,如果您的組織混在一起,取得,或由其他公司會取得使用相同的 DNS 名稱),兩個基礎結構無法與另一個互動。If another organization later registers the same DNS domain name (or if your organization merges with, acquires, or is acquired by another company that uses the same DNS name), the two infrastructures cannot interact with one another.

警告

請勿使用單一標籤 DNS 名稱。Do not use single-label DNS names. 如需詳細資訊,查看 Windows 的單一標籤 DNS 名稱網域設定的相關資訊 (http://go.microsoft.com/fwlink/?LinkId=106631)。For more information, see Information about configuring Windows for domains with single-label DNS names (http://go.microsoft.com/fwlink/?LinkId=106631). 此外,我們不建議使用解除的尾碼,例如.local。Also, we do not recommend using unregistered suffixes, such as .local.

選取前置詞Selecting a prefix

如果您選擇的且已的尾碼已在網路上使用,如下表所示使用前置詞規則選取前置詞的樹系根網域名稱。If you chose a registered suffix that is already in use on the network, select a prefix for the forest root domain name by using the prefix rules in the table below. 新增不目前用來建立新的附屬名稱前置詞。Add a prefix that is not currently in use to create a new subordinate name. 例如,如果您的 DNS 根名稱 contoso.com,您可以建立 Active Directory 森林根網域名稱 concorp.contoso.com 如果命名空間 concorp.contoso.com 尚未在網路上使用。For example, if your DNS root name is contoso.com, you can create the Active Directory forest root domain name concorp.contoso.com if the namespace concorp.contoso.com is not already in use on the network. 命名空間的這個新分支 」 將會專用到 AD DS,而且可以輕鬆地整合現有 DNS 實作。This new branch of the namespace will be dedicated to AD DS and can be integrated easily with the existing DNS implementation.

如果您選取地區網域為森林根網域運作,您可能需要選取新的網域前置詞。If you selected a regional domain to function as a forest root domain, you might need to select a new prefix for the domain. 森林根網域名稱會影響所有森林中的其他網域名稱,因為可能不適當地域根據的名稱。Because the forest root domain name affects all of the other domain names in the forest, a regionally based name might not be appropriate. 如果您使用新的尾碼目前不使用網路,您可以使用它做森林根網域名稱而不需要選擇其他前置詞。If you are using a new suffix that is not currently in use on the network, you can use it as the forest root domain name without choosing an additional prefix.

下表列出的規則選取前置詞的且已 DNS 名稱。The following table lists the rules for selecting a prefix for a registered DNS name.

規則Rule 解釋Explanation
選取 [前置詞不會變成過時。Select a prefix that is not likely to become outdated. 避免名稱,例如 product 列或作業系統,可能會在未來的變更。Avoid names such as a product line or operating system that might change in the future. 我們建議使用一般的名稱,例如 corp 或 ds。We recommend using generic names such as corp or ds.
選取 [包含只網際網路標準字元前置詞。Select a prefix that includes Internet standard characters only. A Z、 z,0-9 與 (-),但無法完全數字。A-Z, a-z, 0-9, and (-), but not entirely numerical.
包含的 15 字元或較少中前置詞。Include 15 characters or less in the prefix. 如果您選擇首碼長度或較少的 15 字元,NetBIOS 名稱為前置詞相同。If you choose a prefix length of 15 characters or less, the NetBIOS name is the same as the prefix.

請務必的 Active Directory DNS 擁有者搭配組織的 DNS 擁有者以取得中,將會使用 Active Directory 命名空間的名稱。It is important for the Active Directory DNS owner to work with the DNS owner for the organization to obtain ownership of the name that will be used for the Active Directory namespace. 如需關於設計支援 AD DS DNS 基礎結構的資訊,請查看建立設計 DNS 基礎架構For more information about designing a DNS infrastructure to support AD DS, see Creating a DNS Infrastructure Design.

記載森林根網域名稱Documenting the forest root domain name

文件所選取的樹系根網域尾碼與 DNS 前置詞。Document the DNS prefix and suffix that you select for the forest root domain. 此時,找出所網域會樹系根。At this point, identify what domain will be the forest root. 您可以將森林根網域名稱資訊新增到 「 規劃網域 」 試算表,您要建立的全新和已升級網域和您的網域名稱計劃的文件。You can add the forest root domain name information to the "Domain Planning" worksheet that you created to document your plan for new and upgraded domains and your domain names. 若要打開它,下載 Job_Aids_Designing_and_Deploying_Directory_and_Security_Services.zip 從工作協助工具的 Windows Server 2003 部署套件 (http://go.microsoft.com/fwlink/?LinkID=102558) 和開放 「 網域規劃 」 (DSSLOGI_5.doc)。To open it, download Job_Aids_Designing_and_Deploying_Directory_and_Security_Services.zip from Job Aids for Windows Server 2003 Deployment Kit (http://go.microsoft.com/fwlink/?LinkID=102558) and open "Domain Planning" (DSSLOGI_5.doc).