The domain is the core logical structure container in Active Directory. Domains contain OU and folder container objects but can also contain leaf objects, such as users, groups, and so forth. A domain typically reflects the organization of the company in which Active Directory is being used, but in large or geographically dispersed organizations, you can create multiple domains, each representing a business unit or location. The main reasons for using multiple domains are to allow separate administration, define security boundaries, and define policy boundaries. Each domain object has a default GPO linked to it that can affect all objects in the domain. The domain object in Active Directory Users and Computers is represented by an icon with three tower computers (refer back to Figure 6-17).