Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

AD and DNS Question

Posted on 2009-07-09
3
Medium Priority
?
277 Views
Last Modified: 2012-05-07
Hi,

This is probably going to sound like a stupid question but I'm trying to get some opinions.  We have one AD Forest with one Child domain and DNS zones provided from a thirdparty solution.  The zones look like:

AD.PARENT.COM

Clients are in the Child domain AD.  We've had a suggestion from one of our teams that we should take the DNS records for all servers and clients in the AD domain and place them into the Parent DNS Zone...  so all server/client entries would go from AD.PARENT.COM to PARENT.COM DNS Zone (they would still be in the "AD" Child Domain for authentication).  They would then disable DDNS on the "AD" Zone.

I have no idea why someone would want to do this (I think they're trying to simplify it by supporting only the parent zone and just leaving the AD servers and service records in the child), but I'm looking for technical reasons why you wouldn't want to.  

I'm wondering if this would cause any issues with Kerberos tickets etc, and does the domain use FQDN to contact clients (assuming the child domain would naturally think it's domain members would be in the same DNS zone)?

Is it best practice to use FQDN where possible or allow your search suffix to do the work?  Is it a stipulation that clients DNS records should exist in the same Zone as the AD they logon to?

Appreciate the help
0
Comment
Question by:Sinder255248
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 14

Accepted Solution

by:
Wonko_the_Sane earned 1000 total points
ID: 24812986
I wouldn't do it... I also fail to see real advantages as opposed to a lot of headaches this can cause.

Read this:
http://technet.microsoft.com/en-us/library/cc773264(WS.10).aspx
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 1000 total points
ID: 24815185

I would consider dumping the entire forest down into the parent domain a more productive use of resources.

Running a disjointed name space is fine if you're completely happy with DNS / AD, which tends to make it pretty inadvisable for most places. I'd have trouble advising anyone actually do it intentionally unless they have very good cause.

Chris
0
 
LVL 8

Author Comment

by:Sinder255248
ID: 24822747
Thanks for the replies on this, from what I take it's probably not a good idea.
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Let's recap what we learned from yesterday's Skyport Systems webinar.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question