In this article, I will show you How to create a Child and tree Domain using the steps below. A child domain is a subdomain of the parent domain. In the active directory hierarchical structure, the function of the child domain is the segmentation of the active directory into smaller parts or segments. For Example, we may have the headquarters of a company serving as the parent domain controller while different branch offices serve as children’s domain to the parent domain. Please see How to create a password reset disk: Reset Windows Password.
Before we can create a child domain we need to install the Active Directory Domain Services (AD DS) role on our Windows Server 2016 making it the parent domain controller.
These are other interesting articles you can read: How to add a new Domain Controller to an Existing Domain, Setup a Domain Controller as Recommended by Microsoft, How to demote and remove a Domain Controller on Windows Servers, Change Active Directory Domain name from dot local to dot com
Adding a Child Domain or Tree Domain to a Domain Controller
Before you can add a child domain make sure you have already setup an Active Directory Domain Service. Read this to know how to Setup a Domain Controller as Recommended by Microsoft.
Open Server Manager of the Server you want to make the child domain. Navigate to Manage > Add Roles and Features.
2. Select Role-based or feature-based installation. Click Next.
3. Select the Destination Server and click Next.
4. Select the server roles “Active Directory Domain Services“. Click Next to the Confirmation page.
5. On the Confirmation Page Click Install.
6. View installation progress and click on “Promote this server to a domain controller“.
Selecting a Child Domain
7. On the Deployment Configuration, Select “Add a new domain to an existing forest”. Select Child Domain as the domain type, enter the parent domain and the name you want to give the new domain.
Click Change to supply the credentials to perform this operation.
Please see How to install Amazon RDS using Terraform, How to Set Up and Configure a Squid Proxy Server, and Active Directory Forest – Trees and Domain and Sites.
Selecting a Tree Domain
8. The difference between tree domain and child domain is that a tree domain will always stand-alone even though its related to the parent domain.
Unlike the child domain that is a sub domain under the parent domain a tree domain is a new domain under the existing forest. Click Next after supplying the credentials to perform the operation.
9. Under Domain Controller Options select the Domain functional level, check the boxes for DNS and GC, select the site name and enter the DSRM password. Click Next.
10. Click Next under the DNS Options. Continue to click Next on the Wizard and stick to the default value.
11. Review your selections and confirm its correct. Click Next.
Prerequisite Check
12. During the prerequisite check is possible you encounter a DNS issue. What this mean is that the domain you are trying to configure is not resolving to the parent domain and there will be need to configure the DNS Server.
Configuring DNS Server
13. When you were setting up the Domain Controller the DNS role was already added. Navigate to the DNS Manager and right-click the server and select Configure a DNS Server…
14. Click Next and follow the wizard. We are selecting the first option which is recommended for small networks.
15. Select “This server maintains the zone”
16. Enter Zone Name.
17. Select Secure Dynamic Update which is recommended for Active Directory.
18. Configuring the forwarders that help this server to resolve queries. Enter the IP Address and the Fully Qualified Domain Name (FQDN) and ensure it is validated OK.
19. Click Next and it will search for Root Hints.
20. Click Finish after successfully configuring the DNS Server.
21. After successfully configuring the DNS Server run the Prerequisites Check again and this time all prerequisites checks will pass successfully.
Click Install and wait for the installation to complete. Immediately the process successfully complete the Server will restart.
22. New Child Domain Created Successfully.
Please see “How to fix the Security Database on the Server does not have a Computer Account for this Workstation Trust Relationship on Windows Server [Part 2]“. Also, see “The trust relationship between this workstation and the primary domain failed“.
Checking System Properties
When you check the System Properties for the Server you will see the child domain as a subdomain to the parent domain. But if it was a Tree Domain it would not show as a subdomain but as a new domain entirely.
Checking Active Directory Sites and Services
Open the Active Directory Sites and Services to complete the replication process. Replication ensures that changes made on one domain controller are propagated to other domain controllers, keeping the directory data synchronized. Expand the servers and right-click NTDS Settings to replicate.
Checking the Active Directory Domains and Trusts
This helps to confirm there is a trusted relationship between the parent domain and the child domain. Right-click either the Parent domain or the Child domain and click on Properties.
Child Domain Properties show a trusted relationship with the Parent Domain.
Parent Domain Properties show a trusted relationship with the Child Domain.
I hope you found this blog post on how to Create a Child and Tree Domain Interesting and helpful. If you have any questions do not hesitate to ask in the comment section.
