How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?

Question

Short version

What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD

Background

I'm working with a company that has various business agreements between many small companies (200 to 400), and varying needs of control, trust, and autonomy between all of these business entities.

The corporate office has one AD Forest that has accounts for 80% of the users in all the companies. Exchange server is here and the company acts similar to a BPOS/Office 365 in regard to providing services to the firms.

They are now considering consolidating IT workload among the 200 silos, and are looking at the following options:

1. Multiple forests (Corporate, and one for each of the 200 companies) with forest trusts to Hosted Exchange

2. Subdomains / Trees in a forest for each company with a "resource domain" for Hosted Exchange

3. Use our current domain, and deploy a read Only Domain Controller (RODC) outside of Hosted Exchange

4. Use our current domain, and deploy a full domain controller to the remote site

5. Do "something" with Forefront Identity Manager (not sure about the features of FIM)

Most of the business agreements have a 5 year termination clause. At that point they can terminate their relationship or they can renew. Other business agreements are more strategic and we want to manage their local desktops as well.

Based on my historic knowledge of AD, it has been (or may still be) possible to gain Enterprise Admin permission rights by compromising a local child domain controller.

This leads me to ask the following:

• How do I deploy AD in a hostile location? Should I use an RODC or Forest Trust?

• Are there any security benefits of using a child domain / tree in the forest?

• What additional staff / management overhead is involved with a "Resource Forest"

Answer 1

Your best option is probably going to be a RODC if you want to be able to have full control over the domain(s).

A RODC is not any regular domain controller. By default all authentication requests are forwarded to a writable DC. RODC's will only store credentials if two conditions are met:

1. Credential caching is enabled (default is disabled)
2. A user has logged in from within the RODC's site

So enterprise admin accounts cannot be compromised unless an EA has logged into the RODC's site. I want to say that account credentials with administrative privileges will never be cached either, but I can't corroborate that. In theory you don't need to ever have an EA log into that site because you can set up RODC-specific administrative users. These users can have admin privileges, but cannot touch anything else on any of the other DC's.

See here: http://technet.microsoft.com/en-us/library/cc732801(WS.10).aspx