An AD instance generates a forest as a container at the highest level for all domains of the instance. A forest may include one or more domain container objects characterised by a common logical structure, a global catalogue, a scheme, and automatic transitive trust relationships. The forest—not a single tree—is thus the default security boundary within which information is forwarded in AD. If these boundaries are not planned in a conscious and structured manner, information may leak out unintentionally and the organisation's security concept may fail. As a consequence, it may be necessary to establish additional forests if different security requirements apply to certain infrastructural components. However, this makes setup and management even more complex.