<

DNS Best Practices for Domain Controllers

Published on
34,183 Points
16,283 Views
4 Endorsements
Last Modified:
Approved
Why shall we use Best Practices?

Because these settings / configurations were tested and implemented in production environments, and achieved great success out of it.


Symptoms of miss configuration on NIC on Domain Controller (DC):

1. We'll see network latency.
2. Domain Controllers (DCs) will not replicate with each other on reguler interval.
3. Servers and Workstations will go out of sync with regards to Domain resources.


Correct the DNS: (Applies to 2003, 2008, 2008R2 and 2012 DCs)

Open CMD run as Administrator and type: ncpa.cpl. This opens Network Connections.

01. Under Network adapters > select TCP/IP IPv4 properties.
02. Always make sure preferred DNS entry as DC itself (if it has DNS role).
03. Secondary DNS can be any DC of the domain which has DNS server role installed.
04. Rest of the servers shall have DNS of PDC as preferred DNS and other as secondary DNS.
05. Remove 127.0.0.1 from preferred and secondary DNS, you can keep it as Third DNS.
06. In IPv6 properties, set it to "Obtain IP Address Automatically" and "Obtain DNS Server Address Automatically".

Note: Never disable IPv6. Why you should not Disable IPv6 and

Why you should leave IPv6 alone

If at all your environment forces to disable IPv6, then I would suggest you to make IPv4 as preferred over IPv6. You can do this by adding

"DisabledComponents " DWORD (32-bit) Value (20, Hexa Decimal) in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

\Tcpip6\Parameters \
For More info Check this link: How to Disable IPv6

07. Make sure "Register this connection's addresses in DNS" has check mark.
08. Disable any unused NIC cards, Because Multihomed Network is not recommended in AD.
Active Directory communication fails on multihomed domain controllers
and Multihomed DCs with DNS by Ace Fekay
09. Never add Default Gateway as DNS address, this will never resolve DNS addresses in AD intigrated DNS.
10. IP Address, Subnet Mask, Default Gateway and Preferred DNS entries are mandatory. If you have second DC in the domain add it as secondary DNS.
11. We can get rid of disabled Network Adapters using this article: Disabled Adapters.

Why NIC Binding is Important:

Any resource in the domain (Server, Workstation or Printer etc) will contact first NIC in Network Connections. If we have more than 1 NIC, the connectivity may fail by trying or will take longer time to connect.

Fix it:

01. In Network Connections select Advanced from File Menu list.
02. From Advanced menu select Advanced Settings.
03. In Adapter and Binding Tab, under Connections area keep active NIC (DNS configured) on top of the list.
04. In provider Order Tab, always keep Microsoft drivers on top.

Note: Sometimes File Menu is not visible, press ALT key from keyboard once to make file menu appear.

Disclaimer:

These settings are default and best practices of mine and so many other experts that I've been observing in multiple communities and forums. There will be no nagitive impact on Domain Controllers. However I would suggest you to test these settings on test environment first.
4
Author:ZenVenky
Enjoy this complimentary article view.

Get unlimited access to our entire library of technical procedures, guides, and tutorials written by certified industry professionals.

Get 7 days free
Click here to view the full article

Using this article for work? Experts Exchange can benefit your whole team.

Learn More
COLLABORATE WITH CERTIFIED PROFESSIONALS
Experts Exchange is a tech solutions provider where users receive personalized tech help from vetted certified professionals. These industry professionals also write and publish relevant articles on our site.
Ask questions about what you read
If you have a question about something within an article, you can receive help directly from the article author. Experts Exchange article authors are available to answer questions and further the discussion.
Learn from the best.