Solved

Modifying DNS Zones - Impact on Active Directory

Posted on 2009-05-05
3
318 Views
Last Modified: 2012-05-06
I set up a Windows 2003 Server Domain with Active Directory and DNS.  Our DNS name (per the Active Directory configuration wizard is hq.company.com.au)

DNS is running on the Domain Controller DC01 and the IP address is 192.168.1.101
 
I also have a router (IP 192.168.1.254) which acts as the DHCP server which assigns clients the Primary DNS address of 192.168.1.101 and the secondary as 192.168.1.254 (the router itself)

This generally works okay, but local computers cannot resolve our website address www.company.com.au unless I set the primary DNS address to the router/default gateway.

I can do this, but it means that the client logon process takes anywhere for 30 seconds - 2 minutes.

So I'm trying to figure out a way to keep the primary DNS server address as the AD/Windows based DNS server and still be able to resolve our website from all local clients.

Is there a simple change I can make to our DNS configuration to support this?  I just figure that the computers on our network should belong to the hq.company.com.au forward lookup zone, but I really don't know.

I've also attached an IPCONFIG from a windows xp client and the domain controller/dns server.   The only thing that looks perhaps a little strange to me (again, I'm guessing) is the DNS suffixes....I note that on the client the connection specific suffix is home.gateway (assigned by the router) or the DNS suffix search list.

Would appreciate some step by step instructions to resolve this.

hq.company.com.au-zone.jpg
company.com.au-zone.jpg
client-ipconfig.jpg
dc-ipconfig.jpg
0
Comment
Question by:drewberrylicious
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 85

Accepted Solution

by:
oBdA earned 500 total points
ID: 24304119
Using external DNS servers in an AD domain just won't die ...
In short: *all* domain members may *only* use DNS servers that are authoritative for your AD DNS name; routers or external DNS server (from the ISP, for example) may *not* appear in the TCP/IP settings of *any* domain member (including the DCs). In a usual setup, this means that only the DC(s) may provide DNS services for AD members. Configure forwarders on your DNS servers to forward external requests to your ISP, or simply rely on the root hints.
If you can't move DHCP from your router to your W2k3 machine, make sure it doesn't provide a suffix search list, and that it *only* returns your DC(s) as DNS servers.
To access your external servers, you will have to create host (A) entries in your AD DNS like "www", pointing to your external IP address. Note that you will *NOT* be able to resolve "hq.company.com.au" to an external address, this *has* to resolve to a DC. If you need to access http://hq.company.com.au, you'll have to install IIS on all DCs and redirect to your external web.
Details about AD and DNS here:

10 DNS Errors That Will Kill Your Network
http://redmondmag.com/features/article.asp?EditorialsID=413

Frequently asked questions about Windows 2000 DNS and Windows Server 2003 DNS
http://support.microsoft.com/?kbid=291382

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003
http://support.microsoft.com/?kbid=825036
0
 

Author Comment

by:drewberrylicious
ID: 24304206
Thanks for the fast and extensive response.

I think that adding the A entry to www might help.

Any suggestions on how to prevent the router assigning DNS suffixes?  

Also, can you tell me the best way to set up forwarders outside of the wizard process?

Also, when I ping hq.company.com.au I get a host not found error.  What's the deal with that?

And finally (sorry to bombard you with more questions), what's the difference between the hq.company.com.au and just company.com.au in the forward lookup zones?

I will definitely read the information on the other links tomrorow, but it's 11pm here now and I need to get some sleep.

Many thanks!
0
 
LVL 85

Expert Comment

by:oBdA
ID: 24304340
> Any suggestions on how to prevent the router assigning DNS suffixes?
Depends on the router ...; you might consider moving DHCP to your server.

> Also, can you tell me the best way to set up forwarders outside of the wizard process?
Start the DNS MMC, open the properties of the server, go to the Forwarders tab.

> Also, when I ping hq.company.com.au I get a host not found error.  What's the deal with that?
Start by making sure that your machine are only using your DC's IP address (do that on the DC as well, instead of 127.0.0.1) and the forwarders are configured, then run "ipconfig /flushdns" on the DNS clients.
You can use dcdiag.exe and netdiag.exe (both support a "/fix" argument to fix small errors on the fly for further troubleshooting.
Windows Server 2003 Service Pack 2 32-bit Support Tools
http://www.microsoft.com/downloads/details.aspx?familyid=96A35011-FD83-419D-939B-9A772EA2DF90&displaylang=en

> what's the difference between the hq.company.com.au and just company.com.au in the forward lookup zones
hq.company.com.au is your AD domain, from what you've said (this zone *has* to exist), the other was probably added manually.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

628 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question