Deciding on the scope of the installation
Before you deploy any part of the auditing infrastructure, you should decide on the scope of the audit installation and whether you want to use a single installation for your entire Active Directory site, or separate audit installations for different geographical areas or functional groups.
The most common deployment scenario is a single installation for each Active Directory forest, so that auditors can query and review information for the entire organization. However, if your Active Directory site has more than one forest, you might want to use more than one installation. If you want to use more than one installation, you should determine the subnetwork segments that will define the scope of each installation.
In Active Directory, a site represents the collection of Internet Protocol (IP) addresses that describe the physical structure of your network. If you are not familiar with how Active Directory sites are defined, you should consult Microsoft documentation for more information.