推荐订阅源

I make myself so perplexed, I met the New Word -- Placeholder Domain Model

Using a Placeholder Domain

The hay-buv.tld domain would be established as a placeholder domain, and the current HB-ACCT domain and HB-ACCT-ROW domain will be upgraded in place as children of the hay-buv.tld domain.

The placeholder domain offers an extra security benefit over a single domain, since the Enterprise Admins and Schema Admins group would exist only in the hay-buv.tld placeholder domain. Because this domain would have very few accounts, and very few domain administrators to keep track of, it would help alleviate the problem of domain administrators adding themselves into either of these groups, which have a lot of power over modifying the Active Directory structure.

Link:http://technet.microsoft.com/zh-cn/library/bb727131(en-us).aspx

Then I found it from <Windows Server 2003 Unleashed>, it is said:

The placeholder domain model, also known as the sterile parent domain model, deserves special mention because of its combination of a single namespace/multiple domain model and the peer-root model. Simply put, the placeholder domain model, shown in Figure 5.14, is composed of an unoccupied domain as the forest root, with multiple subdomains populated with user accounts and other objects.

There are two distinct advantages to this design. First, as with the peer-root model, the schema is separate from the user domains, thus limiting their exposure and helping to pro-tect the schema. Second, the namespace for the user accounts is consistent in the namespace, thus mitigating any potential political issues. In other words, because all users in all locations are at the same logical level in the domain structure, no one group will feel superior or inferior to another. This issue may seem trite, but the psychological nature of humans is finicky, and you may find that this design offers advantages for your organization.