Solved

jacked up dns 'same as parent' host record

Posted on 2011-09-29
6
797 Views
Last Modified: 2012-05-12
Why / How could there be a Host (A) record in a DNS zone with a name (same as parent folder) that has a data value of 10.10.5.0?

Environment is a single AD domain, DNS is integrated, multiple sites, multiple subnets for each site.
This happens to be a remote site that has 5 subnets.  One of which is 10.10.5.0.

Before just deleting it, we'd love to understand how it came to be and how MS DNS would allow a 'Host' record to be x.x.x.0.  Maybe that's common, never done it before.
0
Comment
Question by:AdaMich
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 40

Accepted Solution

by:
Adam Brown earned 334 total points
ID: 36818515
MS DNS will let any IP address be a host record. If your subnet mask is 255.255.255.0 you are probably safe to delete it (assuming there is another Same as Parent IP that points to a Domain Controller). DNS doesn't limit the IP addresses that can be associated to hosts. Only the Subnet Mask does that, and DNS doesn't pay attention to Subnet Masks. For instance, a Server *can* be assigned an IP of 10.10.5.0 if it is on a subnet mask of 255.255.0.0 (or some other). The only reason you can't use 10.10.5.0 on a 255.255.255.0 subnet is because that host address is set aside as the Network ID.
0
 
LVL 40

Assisted Solution

by:Adam Brown
Adam Brown earned 334 total points
ID: 36818521
Note that the entry may have been added erroneously by an admin at some point if the subnet mask is 255.255.255.0 on that subnet. Otherwise you should make sure you don't actually have a server on that IP address.
0
 

Author Comment

by:AdaMich
ID: 36818605
Yeah, each subnet has a /24 mask and no server on that particular network.  Just clients.
The 10.10.5.0  is the network ID, hence my suprise to see it listed as though we could use it in a query.
All the others are correct.

Thanks for the reminder on the host with ip ending in '0'...been using simple segmentation methods too long :)

I don't think it was an erroneous addition, and that is the part that concerns me.
I mean..it could have been, but if not, I'd like to know where it came from.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 40

Expert Comment

by:Adam Brown
ID: 36818612
hard to say where it came from without having audit information from when it was created. That's always one of the tricky parts of IT management :D
0
 
LVL 24

Assisted Solution

by:Sandeshdubey
Sandeshdubey earned 166 total points
ID: 36889997
It seems the dns records were change manually.If you have not applied then some other administrator
has done the same.For future process enable Audit Directory Service Access on the DC if it is not enabled.If any addition or deletion is done you can track the same. It will also audit the changes to Active Directory.

For e.g if Audit Directory Service Access is enabled on the machines where DNS is running then in security log you will see the following events  for deleting a DNS record.If it is not enabled then the event will be not logged.

Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 566
Date:  8/23/2006
Time:  7:28:30 PM
User:  [perp]
Computer: [dns server]
Description:
Object Operation:
  Object Server: DS
  Operation Type: Object Access
  Object Type: dnsNode
  Object Name: DC=Test,DC=zone.com,CN=MicrosoftDNS,CN=System,DC=zone,DC=com
  Handle ID: -
  Primary User Name: [computer name]$
  Primary Domain: [Domain]
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: administrator
  Client Domain: [domain]
  Client Logon ID: (0x0,0x729EE07)
  Accesses: Write Property
   
  Properties:
 Write Property
  Default property set
   dnsRecord
   dNSTombstoned
   dnsNode

  Additional Info:
  Additional Info2:
  Access Mask: 0x20

0
 

Author Closing Comment

by:AdaMich
ID: 36891376
Thanks for the responses.
I guess I was just fishing to validate, or invalidate, an automatic entry.
Off to delete the bogus bugger.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question