Multi-Domain, Trees, and Forests in Active Directory

Concept

In enterprise Active Directory environments, identities and securable assets are organized across three hierarchical levels:

Domain: The basic administrative unit containing its own directory partition (ntds.dit), default domain policies, security principals, and Domain Controllers (DCs).
Domain Tree: A contiguous DNS namespace hierarchy of domains (e.g., corp.ad.sec and emea.corp.ad.sec) automatically linked by two-way transitive parent-child trust relationships.
Forest: The top-level administrative and security container. It encompasses one or more domain trees. All domains within a forest share a single Schema partition, a single Configuration partition, and a common Global Catalog (GC).

Why It Matters in DFIR

When responding to an intrusion inside a child or regional subsidiary domain:

The Illusion of Boundary Isolation: System and network administrators frequently assume that compromising subsidiary.corp.local does not threaten root corp.local. In reality, a compromised child Domain Admin can abuse inter-domain trusts (sIDHistory, inter-realm Golden Tickets) to compromise the root forest.
Directory Partitioning and Log Dispersal: Domain naming contexts are not replicated across DCs of other domains. If an attacker creates or leverages a user account in Domain A, corresponding logon and object modification events appear exclusively on Domain A’s DCs. Conversely, the Global Catalog (GC, port 3268/3269) replicates a read-only Partial Attribute Set (PAS) enterprise-wide.
Blast Radius Determination: The moment an adversary obtains Domain Admins rights within any child domain of a forest, forensic investigators must treat the entire forest as compromised.

How It Works

Active Directory Naming Contexts (Partitions)

Each DC’s ntds.dit database is partitioned into distinct naming contexts:

                  ┌──────────────────────────────────────────────┐
                  │             ACTIVE DIRECTORY FOREST          │
                  ├──────────────────────────────────────────────┤
                  │ 1. Schema NC (Replicated across ALL forest)  │
                  │ 2. Configuration NC (Replicated ALL forest)  │
                  └──────────────────────┬───────────────────────┘
                                         │
               ┌─────────────────────────┴─────────────────────────┐
               ▼                                                   ▼
┌──────────────────────────────┐                ┌──────────────────────────────┐
│  Root Domain: corp.local     │                │  Child Domain: emea.corp     │
├──────────────────────────────┤                ├──────────────────────────────┤
│ 3. Domain NC (corp.local)    │◄──Parent-Child►│ 3. Domain NC (emea.corp)     │
│    (Replicated ONLY within   │     Trust      │    (Replicated ONLY within   │
│     corp.local DCs)          │                │     emea.corp DCs)           │
└──────────────────────────────┘                └──────────────────────────────┘

Schema Partition: Defines all object classes and attributes. Identical across all DCs in the forest. Controlled by the Schema Master FSMO role.
Configuration Partition: Stores physical AD topology (sites, subnets, trusts, replication links). Identical across all DCs in the forest.
Domain Partition: Stores all objects specific to that domain. Each domain has its own independent domain partition.
Global Catalog (GC): Hosted on designated DCs, storing a full replica of its host domain partition plus a partial, read-only copy of essential attributes (PAS) from all other domains in the forest.

What Is Possible

Full Forest Reconnaissance by Any Standard User: Any domain user can query LDAP or DNS across the Configuration partition to map out every domain, trust relationship, and DC in the entire forest.
Cross-Domain Resource Access: Authenticated users can access authorized resources in peer domains through automated Kerberos referrals.
Horizontal-to-Vertical Forest Escalation: A child domain attacker who extracts the child domain krbtgt key can forge inter-realm tickets containing Enterprise Admins (RID 519) in sIDHistory unless inter-forest SID filtering is specifically enforced (which is disabled by default within an intra-forest trust).

What Is Not Possible

Enforcing Impenetrable Security Isolation Between Domains in the Same Forest: Architecture-level isolation is technically impossible between domains of the same forest.
Reviewing Domain B Events on Domain A Controllers: Security event logs (such as Event 4625 for password spraying against Domain B users) will not be forwarded or visible on Domain A DCs.
Replicating Password Hashes Outside Their Own Domain: Domain partitions containing NTLM hashes and Kerberos keys are never replicated outside their domain. The Global Catalog does not replicate sensitive credential attributes like unicodePwd.

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”We have two separate domains in the same forest, so subsidiary compromise does not threaten headquarters.”	False. The forest is the sole security boundary. Tier 0 compromise of any domain allows takeover of the forest root.
”I inspected the root DC event logs and found no evidence of suspicious accounts.”	Account creation in child domains is only logged in that child domain’s DC logs.
”The Global Catalog stores all attributes for all enterprise objects.”	The GC only stores the Partial Attribute Set (PAS). Password hashes and Kerberos keys are strictly excluded.

Concrete Forensic Example

During a ransomware incident, an attacker gains initial access to a workstation in a branch office domain (ch.megacorp.local) and extracts local Domain Admin credentials:

On the branch DC, the attacker performs DCSync and extracts the krbtgt NTLM hash of ch.megacorp.local.
The attacker crafts an inter-realm TGT with sIDHistory set to S-1-5-21-ROOT-519 (Enterprise Admins of megacorp.local).
When requesting a TGS against root services, the root KDC processes the ticket without stripping the SID because intra-forest trusts do not filter forest-internal SIDs by default. The attacker gains immediate root domain dominance.

Key Forensic Artefacts

Active Directory Configuration Naming Context:
- CN=Partitions,CN=Configuration,DC=root,DC=local: contains crossRef objects for all authorized domains in the forest.
Child Domain DC Events:
- Event ID 4662: Directory Service replication rights abuse (DCSync).
- Event ID 4720: Suspicious local account creation in the branch domain.
Root Domain DC Events:
- Event ID 4769: Inter-realm TGS requests for krbtgt/root.local.
- Event ID 4624 (Logon Type 3): Administrative network logons from child domain principals into root Tier 0 systems.

Investigation Methods

Enumerate the Entire Forest Topology: Query [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() to identify all domains, trees, and Global Catalogs.
Catalog Domain Controllers per Domain: Map out DC endpoints across all domains to ensure targeted log collection of Events 4624, 4625, 4672, and 4769.
Verify Intra-Forest Trust Filtering: Check whether SID Filtering or quarantine flags were configured on intra-forest trusts (netdom trust <Domain> /filterSIDs:Yes).

Investigative Tooling

PowerShell Active Directory Module:

Get-ADForest | Select-Object Name, RootDomain, Domains, GlobalCatalogs
Get-ADDomain -Identity "emea.corp.local" | Select-Object NetBIOSName, DomainSID, ReadOnlyReplicaDirectoryServers

SharpHound / BloodHound: Collect multi-domain topologies (--collectionmethods All,Trusts) to expose escalation pathways from child domains to Enterprise Admins.

Key Takeaways

Domains are administrative boundaries; the forest is the sole security boundary.
Compromising any domain in a forest grants an adversary mathematical pathways to compromise the entire forest.
DC security event logs are not cross-replicated across domains; DFIR analysis requires log collection from every affected domain.