Active Directory Forests and the Global Catalog

The Global Catalog (GC) in Windows 2000 Active Directory (AD) is widely misunderstood and it's no wonder why: The catalog serves multiple purposes, has tons of features, and houses dissimilar forms of data. To understand the GC, you must first understand the concept of a "forest." A forest is a collection of one or more AD trees organized as peers and connected by two-way transitive trust relationships between the root domains of each tree. All trees in a forest share a common schema, configuration, and GC.

Every domain controller in a forest stores three full, writable directory partitions:

A GC server is a Win2K domain controller that stores these three writable directory partitions, as well as a partial, read-only copy of all other domain directory partitions in the forest. The additional directory partitions are "partial" because although they collectively contain every object in the directory, they have a limited set of specific attributes for each object. The AD replication system automatically builds the GC. AD automatically designates the first domain controller in a forest as a GC server, although any domain controller can be a GC server. (You can configure this controller in the NTDS Settings Properties dialog box in the AD Sites and Services tool.)

All three directory partitions exist on a GC server, whether they are full or partial partitions, in one directory database (Ntds.dit) on that server. No separate storage area is necessary for GC attributes: The Global Catalog Server treats them as additional information in the domain controller directory database. When you add a new domain to a forest, AD automatically stores the information about the new domain in the configuration directory partition, which the GC server (and all domain controllers) automatically touches through replication of forest-wide information. Because the GC stores every object in the forest, software developers can use the catalog to locate objects in any domain without a referral to a different server. When a search request is sent to port 389 (the default Lightweight Directory Access Protocol—LDAP—port for AD) on a specific domain, computer, or IP address, the search is performed on one domain directory partition. If the object isn't found in that directory partition (and isn't in the schema or configuration directory partitions), the request is referred to a domain controller in a different domain that might contain the requested object (on the basis of the distinguished name—DN—you present in the search request). Such a referral is called an LDAP referral and can be very expensive in terms of the time it takes the search to find what it's looking for.

When a search request is sent to port 3268 (the default GC port), the search includes all directory partitions in the forest. In other words, a GC server processes the search. A GC search can return results for objects in any domain without generating a referral to a domain controller in a different domain. This tool is extremely powerful for software developers in a huge company with AD forests residing in different locations all over the world.