My test Environment grows. Today I finished the domain structure.
I created a one forest, a root domain and two child domains.
The root domain only consist of two domaincontrollers and has no other servers or services at the moment.
The first child domain is my resource domain for physical systems that I need for the lab. It holds my hyper-v hosts, storage systems, switches, firewalls and router. So now you will ask yourself “why so complex and two domains?”. I like to follow some security best practices. One is, that you should split administrativ rights for your Hyper-V hosts and storage systems. That means no administrator who is not part of the environment and allowed to make changes on that systems, should be able to connect to them. The easiest way is to creat a resource and work domain. Both have different administator accounts and because of the root domain and the restricted access to it, you cannot deligate administrators on other domains.
That also prevents your application servers and active directory from corruption, from someone who maybe have occupied your Hyper-V and physical systems.