<

DNS Best Practices for Domain Controllers

Published on
34,598 Points
16,698 Views
4 Endorsements
Last Modified:
Approved
Why shall we use Best Practices?

Because these settings / configurations were tested and implemented in production environments, and achieved great success out of it.


Symptoms of miss configuration on NIC on Domain Controller (DC):

1. We'll see network latency.
2. Domain Controllers (DCs) will not replicate with each other on reguler interval.
3. Servers and Workstations will go out of sync with regards to Domain resources.


Correct the DNS: (Applies to 2003, 2008, 2008R2 and 2012 DCs)

Open CMD run as Administrator and type: ncpa.cpl. This opens Network Connections.

01. Under Network adapters > select TCP/IP IPv4 properties.
02. Always make sure preferred DNS entry as DC itself (if it has DNS role).
03. Secondary DNS can be any DC of the domain which has DNS server role installed.
04. Rest of the servers shall have DNS of PDC as preferred DNS and other as secondary DNS.
05. Remove 127.0.0.1 from preferred and secondary DNS, you can keep it as Third DNS.
06. In IPv6 properties, set it to "Obtain IP Address Automatically" and "Obtain DNS Server Address Automatically".

Note: Never disable IPv6. Why you should not Disable IPv6 and

Why you should leave IPv6 alone

If at all your environment forces to disable IPv6, then I would suggest you to make IPv4 as preferred over IPv6. You can do this by adding

"DisabledComponents " DWORD (32-bit) Value (20, Hexa Decimal) in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

\Tcpip6\Parameters \
For More info Check this link: How to Disable IPv6

07. Make sure "Register this connection's addresses in DNS" has check mark.
08. Disable any unused NIC cards, Because Multihomed Network is not recommended in AD.
Active Directory communication fails on multihomed domain controllers
and Multihomed DCs with DNS by Ace Fekay
09. Never add Default Gateway as DNS address, this will never resolve DNS addresses in AD intigrated DNS.
10. IP Address, Subnet Mask, Default Gateway and Preferred DNS entries are mandatory. If you have second DC in the domain add it as secondary DNS.
11. We can get rid of disabled Network Adapters using this article: Disabled Adapters.

Why NIC Binding is Important:

Any resource in the domain (Server, Workstation or Printer etc) will contact first NIC in Network Connections. If we have more than 1 NIC, the connectivity may fail by trying or will take longer time to connect.

Fix it:

01. In Network Connections select Advanced from File Menu list.
02. From Advanced menu select Advanced Settings.
03. In Adapter and Binding Tab, under Connections area keep active NIC (DNS configured) on top of the list.
04. In provider Order Tab, always keep Microsoft drivers on top.

Note: Sometimes File Menu is not visible, press ALT key from keyboard once to make file menu appear.

Disclaimer:

These settings are default and best practices of mine and so many other experts that I've been observing in multiple communities and forums. There will be no nagitive impact on Domain Controllers. However I would suggest you to test these settings on test environment first.
4
Author:ZenVenky
Ask questions about what you read
If you have a question about something within an article, you can receive help directly from the article author. Experts Exchange article authors are available to answer questions and further the discussion.
Get 7 days free