What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD
I'm working with a company that has various business agreements between many small companies (200 to 400), and varying needs of control, trust, and autonomy between all of these business entities.
The corporate office has one AD Forest that has accounts for 80% of the users in all the companies. Exchange server is here and the company acts similar to a BPOS/Office 365 in regard to providing services to the firms.
They are now considering consolidating IT workload among the 200 silos, and are looking at the following options:
Multiple forests (Corporate, and one for each of the 200 companies) with forest trusts to Hosted Exchange
Subdomains / Trees in a forest for each company with a "resource domain" for Hosted Exchange
Use our current domain, and deploy a read Only Domain Controller (RODC) outside of Hosted Exchange
Use our current domain, and deploy a full domain controller to the remote site
Do "something" with Forefront Identity Manager (not sure about the features of FIM)
Most of the business agreements have a 5 year termination clause. At that point they can terminate their relationship or they can renew. Other business agreements are more strategic and we want to manage their local desktops as well.
Based on my historic knowledge of AD, it has been (or may still be) possible to gain Enterprise Admin permission rights by compromising a local child domain controller.
This leads me to ask the following:
How do I deploy AD in a hostile location? Should I use an RODC or Forest Trust?
Are there any security benefits of using a child domain / tree in the forest?
What additional staff / management overhead is involved with a "Resource Forest"