Designing a Directory Services Architecture
Structure and namespace
Directory design is about logical structure and physical placement. Candidates must understand forests, trees, domains, organisational units (OUs), and sites. The forest is the security boundary; the domain is a replication and administrative boundary; the OU is a delegation and policy-application container. Design the namespace first (a routable, owned DNS name), then the forest count (usually one), then domain count (driven by replication, policy, or political constraints), then the OU hierarchy (driven by delegation of administration and Group Policy targeting).
Physical design
Sites map to well-connected IP subnets. Site design drives replication topology, client logon affinity, and service location via SRV records. Know the roles of domain controllers, global catalogue servers, read-only domain controllers, and the FSMO role holders. Understand replication concepts: intrasite versus intersite, site links and cost, and the trade-off between replication frequency and bandwidth.
Traps
Stems often ask for the minimum number of forests or domains, and the correct answer is usually fewer than instinct suggests. Do not create a domain for every department; use OUs. Conversely, do not assume a single domain when a hard security or replication constraint demands separation. Another trap is confusing the schema master with the domain naming master, or placing a global catalogue where logon traffic will saturate a WAN link.
Rule of thumb
One forest unless a true security boundary is required; one domain unless replication or policy demands otherwise; OUs for delegation and policy. Design sites around subnets and link speed, and place a local domain controller or RODC wherever WAN authentication latency is unacceptable.
Also know
Trust types and direction, DNS integration with the directory, and the impact of schema changes.