AD and DNS Question

Hi,

This is probably going to sound like a stupid question but I'm trying to get some opinions.  We have one AD Forest with one Child domain and DNS zones provided from a thirdparty solution.  The zones look like:

AD.PARENT.COM

Clients are in the Child domain AD.  We've had a suggestion from one of our teams that we should take the DNS records for all servers and clients in the AD domain and place them into the Parent DNS Zone...  so all server/client entries would go from AD.PARENT.COM to PARENT.COM DNS Zone (they would still be in the "AD" Child Domain for authentication).  They would then disable DDNS on the "AD" Zone.

I have no idea why someone would want to do this (I think they're trying to simplify it by supporting only the parent zone and just leaving the AD servers and service records in the child), but I'm looking for technical reasons why you wouldn't want to.  

I'm wondering if this would cause any issues with Kerberos tickets etc, and does the domain use FQDN to contact clients (assuming the child domain would naturally think it's domain members would be in the same DNS zone)?

Is it best practice to use FQDN where possible or allow your search suffix to do the work?  Is it a stipulation that clients DNS records should exist in the same Zone as the AD they logon to?

Appreciate the help
LVL 8
Sinder255248Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Wonko_the_SaneCommented:
I wouldn't do it... I also fail to see real advantages as opposed to a lot of headaches this can cause.

Read this:
http://technet.microsoft.com/en-us/library/cc773264(WS.10).aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Chris DentPowerShell DeveloperCommented:

I would consider dumping the entire forest down into the parent domain a more productive use of resources.

Running a disjointed name space is fine if you're completely happy with DNS / AD, which tends to make it pretty inadvisable for most places. I'd have trouble advising anyone actually do it intentionally unless they have very good cause.

Chris
0
Sinder255248Author Commented:
Thanks for the replies on this, from what I take it's probably not a good idea.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.