Are there any recommendations/best practices regarding SDI Security Domain Servers? e.g. how many? one per site?

(We are tidying up a mixed NetWare/OES11 environment, removing as much NetWare as possible and just want to leave things in the best possible shape)

Thanks
David