Why the placeholder domain?

[gbiello]

If creating a new Win2K domain for a company where only a single domain is needed, I would simply create the domain, say xyz.com.

I've heard recommendations from a couple of different sources, however, that recommend a placeholder domain that is simply a pair of DC's, that house no data or users (excluding admin). Thus xyz.com would a placeholder domain, and the working domain would be a child domain, say xyzzy.xyz.com.

I know of scenarios with a placeholder domain, and multiple child domains, but not with a single child domain.

Could someone possibly explain why this might have been recommended? I believe it has something to do with security.

Thanks,
-gbiello

 

[brontosaurus]

You're right, it was recommended for security purposes, but it was also recommended for management purposes in large domains (to centralize admins). On the security side, all it's really doing is providing another layer to get past, working under the assumption that this root domain might be the "closest" to your Internet connection...