Server 2008 DNS record keeps disappearing

Why does the server have two IP addresses?
That is not something I would tend to recommend, particularly if the server is dual homed. Exchange doesn't react well to being dual homed.

-M

Mestha, the server has one IP address for an OWA redirect site. It's in the same subnet and we've run Exchange like this for years with no problem.

Here is something that seems interesting..I turned up auditing like Chris suggested. When I create a normal DNS record, an event gets logged similar to below:

Event Type:             Success Audit
Event Source:          Security
Event Category:       Directory Service Access
Event ID:  566
Date:                       1/29/2009
Time:                       9:58:51 AM
User:                       NT AUTHORITY\SYSTEM
Computer:               DC1
Description:
Object Operation:
                Object Server:         DS
                Operation Type:      Object Access
                Object Type:            dnsNode
                Object Name:         DC=EXCH1,DC=domain.com,CN=MicrosoftDNS,CN=System,DC=domain,DC=com
                Handle ID:               -
                Primary User Name:               DC1$
                Primary Domain:     DOMAIN
                Primary Logon ID:   (0x0,0x3E7)
                Client User Name:  DC1$
                Client Domain:        DOMAIN
                Client Logon ID:       (0x0,0x6A5EEBCD)
                Accesses:                WRITE_DAC
                                                WRITE_OWNER
                                               
                Properties:
                WRITE_DAC
WRITE_OWNER
                dnsNode
 
                Additional Info:      
                Additional Info2:    
                Access Mask:          0xC0000

Also an event gets logged for the PTR record. However for this one record, an additional event immediately gets logged similar to this:

Event Type:             Success Audit
Event Source:          Security
Event Category:       Directory Service Access
Event ID:  566
Date:                       1/29/2009
Time:                       9:58:51 AM
User:                       DOMAIN\Administrator
Computer:               DC1
Description:
Object Operation:
                Object Server:         DS
                Operation Type:      Object Access
                Object Type:            dnsNode
                Object Name:         DC=EXCH1,DC=domain.com,CN=MicrosoftDNS,CN=System,DC=domain,DC=com
                Handle ID:               -
                Primary User Name:               DC1$
                Primary Domain:     DOMAIN
                Primary Logon ID:   (0x0,0x3E7)
                Client User Name:  Administrator
                Client Domain:        DOMAIN
                Client Logon ID:       (0x0,0x6A8C95EF)
                Accesses:                Write Property
                                               
                Properties:
                Write Property
                                Default property set
                                                dnsRecord
                                                dNSTombstoned
                dnsNode
 
                Additional Info:      
                Additional Info2:    
                Access Mask:          0x20

It's as if something is causing the record to be marked for deletion right after I create it. Oddly enough, this only happens for records created in one particular subnet, but it does not matter which DNS zone I create the records for.

Does this make sense to anyone?

OWA redirect site?
This wasn't an attempt to do SSL certificates on the cheap by using two different web sites? This was a technique I was pushing as well, but no longer do so, due to the problems with it and that the correct way using a single IP address and SSL is much more reliable.

The fact that you have done something for years without problems does not mean that
a. It was the correct thing to do in the first place
b. It will continue to work.

I refer to the "its been working for years" as the drunk drivers excuse.

I still think this is a problem with AD not accepting your static DNS entry rather than allowing Windows and AD to manage it.

-M

> but it does not matter which DNS zone I create the records for.

You mean you can create this in any Forward Lookup Zone and suffer from the same problem?

I don't see why AD would object to a DNS entry. The worst that can happen is  the client will receive an access denied error when it attempts to update the record (based on the ACL for the record).

Can you take a look at the record using ADSIEdit.msc? You'll find it under the "Domain" folder based on the path above. You can see it in AD Users and Computers as well, but it won't show you anything interesting.

Chris

I can create it in any forward lookup zone using any IP address in that particular subnet and will have the problem. If I choose a different subnet, it works.
I looked at the record in ADSI, nothing seems strange about it except the created time stamp remains as 10/1/2008, as if the record just gets reanimated whenever I add it back into DNS. In ADSi it looks like the record never actually goes away when it is deleted in DNS, just the values for its IP addresses disappear.

Went ahead and just deleted the static record, then enabled DNS registration on the nic, and ran ipconfig /registerdns. The record then showed up in DNS, but later disappeared again.

The OWA redirect site was setup as an easy way to send people to the full url with HTTPS and /exchange because they couldn't ever remember the full path.  Originally the main OWA site used a script to perform the redirect but the script seemed to not always work. I can move that site to a different server for testing purposes or if you have a better way to do the redirect, I'm open to that.

But I would still like to figure out this DNS issue, thanks for the help.

You can actually see it in ADSIEdit after it has been deleted and is no longer visible in the GUI?

I would be very tempted to delete the version of the record you see in ADSIEdit. Just to confirm, it should show up as an object of dnsNode class.

Chris

Sorry for the delay in getting back about this. I was thinking the same thing about the record in ADSI. Rather than experiment on a live server I deleted the dnsNode class for a workstation first. After doing that the workstation was getting random errors--MMC consoles would work for some servers and not others, it could access some network drives and not others, would give RPC errors using remote tools. After I unjoined and rejoined it to the domain everything was fine again. Not sure if this was a fluke but I don't want to risk that on a production server. I'll probably just live with the problem for now and maybe address it later if it becomes a bigger issue.

That's odd, DNS is pretty easy easy on AD / domain members for the most part. You could delete your entire forward lookup zone and recover in a very short time with very few issues.

Still, I can appreciate the reluctance to do anything like that on a production domain :)

Chris

Yea, I really don't know what happened. I've actually deleted the entire forward lookup zone before and re-created it without any problems, but did it through the DNS console instead of ADSI. May do some more testing later if I have time.