Answer:

Active Directory forests can be constructed according to several different architectural models, including:

Organizational forest model

Resource forest model

Restricted access forest model

The simplest of these models is the organizational forest model. In smaller organizations, this model establishes a single AD forest that contains all the organization's resources. Larger organizations may have a separate Active Directory forest for each department or division. Creating multiple AD forests provides an isolation boundary between departments. If collaboration is required between departments, a forest level trust can be created.

A second type of forest model is the resource forest model. In this model, user accounts are created within an organizational forest. Separate forests are created to accommodate the resources related to individual departments, divisions or projects. These resource forests do not contain user accounts aside from those required for administrative purposes. Instead, trust relationships allow users from the organizational forest to access resources in resource forests. Resource forests are a good choice for helping to isolate problems. An Active Directory problem occurring in one resource forest will not affect another resource forest because of the forest level boundaries that are in place.

A third forest design model is the restricted access forest model. The This model involves multiple forests, with no trust relationships between them. The users in one forest cannot access any of the resources in another forest. This design is used in high-security environments because it creates extremely strong isolation boundaries.

Single forest vs. multi-forest AD design

Although various forest design models allow for the creation of multiple Active Directory forests, such models are complex and expensive to implement. Typically, only the largest organizations use them.

Smaller organizations that want to have structures that are somewhat similar,