The Domain Aliases field in the Forescout User Directory plugin is specifically designed to configure additional domain names, such as subdomains or alternative User Principal Name (UPN) suffixes, that are associated with the primary Active Directory server being configured. When Forescout detects a user authenticating from a subdomain (e.g., [email protected]), this configuration allows the plugin to correctly resolve the user's identity and group memberships against the parent domain's directory service. This ensures seamless user identification across a multi-domain Active Directory forest.

A. Replicas: This field is used to specify secondary or backup domain controllers for redundancy and load balancing, not for handling subdomains.

B. Address: This field specifies the IP address or FQDN of the primary domain controller for the domain being configured, not its subdomains.

C. Parent Groups: This option defines a specific organizational unit (OU) or container to use as the starting point for group searches, which is unrelated to domain structure.

E. DNS Detection: This is a feature to automatically discover domain controllers using DNS records, not a field for manually defining subdomain relationships.

1. Forescout User Directory Plugin Configuration Guide, Version 8.4.2, Page 21, Table 6: "Active Directory Server – General Tab".

The guide describes the Domain Aliases field as: "Enter any domain aliases that are associated with this Active Directory server. Separate multiple entries with a comma. For example, if the domain is domain.com, you can enter sub.domain.com as an alias." This directly confirms its use for subdomains.

2. Forescout User Directory Plugin Configuration Guide, Version 8.4.2, Page 21, Table 6: "Active Directory Server – General Tab".

The guide describes the Replicas field as: "Enter the IP addresses or resolvable hostnames of replica LDAP servers that can be used if the primary server is not available." This confirms its purpose is for high availability, not subdomains.