Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 821
  • Last Modified:

jacked up dns 'same as parent' host record

Why / How could there be a Host (A) record in a DNS zone with a name (same as parent folder) that has a data value of 10.10.5.0?

Environment is a single AD domain, DNS is integrated, multiple sites, multiple subnets for each site.
This happens to be a remote site that has 5 subnets.  One of which is 10.10.5.0.

Before just deleting it, we'd love to understand how it came to be and how MS DNS would allow a 'Host' record to be x.x.x.0.  Maybe that's common, never done it before.
0
AdaMich
Asked:
AdaMich
  • 3
  • 2
3 Solutions
 
Adam BrownSr Solutions ArchitectCommented:
MS DNS will let any IP address be a host record. If your subnet mask is 255.255.255.0 you are probably safe to delete it (assuming there is another Same as Parent IP that points to a Domain Controller). DNS doesn't limit the IP addresses that can be associated to hosts. Only the Subnet Mask does that, and DNS doesn't pay attention to Subnet Masks. For instance, a Server *can* be assigned an IP of 10.10.5.0 if it is on a subnet mask of 255.255.0.0 (or some other). The only reason you can't use 10.10.5.0 on a 255.255.255.0 subnet is because that host address is set aside as the Network ID.
0
 
Adam BrownSr Solutions ArchitectCommented:
Note that the entry may have been added erroneously by an admin at some point if the subnet mask is 255.255.255.0 on that subnet. Otherwise you should make sure you don't actually have a server on that IP address.
0
 
AdaMichAuthor Commented:
Yeah, each subnet has a /24 mask and no server on that particular network.  Just clients.
The 10.10.5.0  is the network ID, hence my suprise to see it listed as though we could use it in a query.
All the others are correct.

Thanks for the reminder on the host with ip ending in '0'...been using simple segmentation methods too long :)

I don't think it was an erroneous addition, and that is the part that concerns me.
I mean..it could have been, but if not, I'd like to know where it came from.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Adam BrownSr Solutions ArchitectCommented:
hard to say where it came from without having audit information from when it was created. That's always one of the tricky parts of IT management :D
0
 
SandeshdubeyCommented:
It seems the dns records were change manually.If you have not applied then some other administrator
has done the same.For future process enable Audit Directory Service Access on the DC if it is not enabled.If any addition or deletion is done you can track the same. It will also audit the changes to Active Directory.

For e.g if Audit Directory Service Access is enabled on the machines where DNS is running then in security log you will see the following events  for deleting a DNS record.If it is not enabled then the event will be not logged.

Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 566
Date:  8/23/2006
Time:  7:28:30 PM
User:  [perp]
Computer: [dns server]
Description:
Object Operation:
  Object Server: DS
  Operation Type: Object Access
  Object Type: dnsNode
  Object Name: DC=Test,DC=zone.com,CN=MicrosoftDNS,CN=System,DC=zone,DC=com
  Handle ID: -
  Primary User Name: [computer name]$
  Primary Domain: [Domain]
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: administrator
  Client Domain: [domain]
  Client Logon ID: (0x0,0x729EE07)
  Accesses: Write Property
   
  Properties:
 Write Property
  Default property set
   dnsRecord
   dNSTombstoned
   dnsNode

  Additional Info:
  Additional Info2:
  Access Mask: 0x20

0
 
AdaMichAuthor Commented:
Thanks for the responses.
I guess I was just fishing to validate, or invalidate, an automatic entry.
Off to delete the bogus bugger.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now