Solved

jacked up dns 'same as parent' host record

Posted on 2011-09-29
6
802 Views
Last Modified: 2012-05-12
Why / How could there be a Host (A) record in a DNS zone with a name (same as parent folder) that has a data value of 10.10.5.0?

Environment is a single AD domain, DNS is integrated, multiple sites, multiple subnets for each site.
This happens to be a remote site that has 5 subnets.  One of which is 10.10.5.0.

Before just deleting it, we'd love to understand how it came to be and how MS DNS would allow a 'Host' record to be x.x.x.0.  Maybe that's common, never done it before.
0
Comment
Question by:AdaMich
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 40

Accepted Solution

by:
Adam Brown earned 334 total points
ID: 36818515
MS DNS will let any IP address be a host record. If your subnet mask is 255.255.255.0 you are probably safe to delete it (assuming there is another Same as Parent IP that points to a Domain Controller). DNS doesn't limit the IP addresses that can be associated to hosts. Only the Subnet Mask does that, and DNS doesn't pay attention to Subnet Masks. For instance, a Server *can* be assigned an IP of 10.10.5.0 if it is on a subnet mask of 255.255.0.0 (or some other). The only reason you can't use 10.10.5.0 on a 255.255.255.0 subnet is because that host address is set aside as the Network ID.
0
 
LVL 40

Assisted Solution

by:Adam Brown
Adam Brown earned 334 total points
ID: 36818521
Note that the entry may have been added erroneously by an admin at some point if the subnet mask is 255.255.255.0 on that subnet. Otherwise you should make sure you don't actually have a server on that IP address.
0
 

Author Comment

by:AdaMich
ID: 36818605
Yeah, each subnet has a /24 mask and no server on that particular network.  Just clients.
The 10.10.5.0  is the network ID, hence my suprise to see it listed as though we could use it in a query.
All the others are correct.

Thanks for the reminder on the host with ip ending in '0'...been using simple segmentation methods too long :)

I don't think it was an erroneous addition, and that is the part that concerns me.
I mean..it could have been, but if not, I'd like to know where it came from.
0
Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.

 
LVL 40

Expert Comment

by:Adam Brown
ID: 36818612
hard to say where it came from without having audit information from when it was created. That's always one of the tricky parts of IT management :D
0
 
LVL 24

Assisted Solution

by:Sandeshdubey
Sandeshdubey earned 166 total points
ID: 36889997
It seems the dns records were change manually.If you have not applied then some other administrator
has done the same.For future process enable Audit Directory Service Access on the DC if it is not enabled.If any addition or deletion is done you can track the same. It will also audit the changes to Active Directory.

For e.g if Audit Directory Service Access is enabled on the machines where DNS is running then in security log you will see the following events  for deleting a DNS record.If it is not enabled then the event will be not logged.

Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 566
Date:  8/23/2006
Time:  7:28:30 PM
User:  [perp]
Computer: [dns server]
Description:
Object Operation:
  Object Server: DS
  Operation Type: Object Access
  Object Type: dnsNode
  Object Name: DC=Test,DC=zone.com,CN=MicrosoftDNS,CN=System,DC=zone,DC=com
  Handle ID: -
  Primary User Name: [computer name]$
  Primary Domain: [Domain]
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: administrator
  Client Domain: [domain]
  Client Logon ID: (0x0,0x729EE07)
  Accesses: Write Property
   
  Properties:
 Write Property
  Default property set
   dnsRecord
   dNSTombstoned
   dnsNode

  Additional Info:
  Additional Info2:
  Access Mask: 0x20

0
 

Author Closing Comment

by:AdaMich
ID: 36891376
Thanks for the responses.
I guess I was just fishing to validate, or invalidate, an automatic entry.
Off to delete the bogus bugger.
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This article shows theĀ method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlleā€¦
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question