In flat SCCM infrastructure deployment across multiple domains it becomes troublesome to perform User/Group/Forest/System discoveries in domains other than Site Server domain, especially in DMZ, this is because Site Server has to be able to talk to other domains domain controllers and security requirements not always allow that.

This could be improved upon if we could choose to perform AD related discoveries from Site Systems (for example MP or specialized role for that purpose) other than Site Server as illustrated in the picture attached.