Solved

AD DNS Move Zone

Posted on 2013-10-31
15
653 Views
Last Modified: 2013-10-31
Hello,

Currently I have two AD Domains with their own DNS and we want to eliminate one of them as the second domain is no longer needed.

Domain 1 and Domain 2 have a full trust setup between them.  I have already disjoined and re-joined all the machines from Domain 2 into Domain 1.  Most of the machines in Domain 2 are statically assigned IPs - their DNS info has been updated to point to Domain 1 AD/DNS servers.  The rest are setup through DHCP and DHCP as been updated with Domain 1 info for DNS settings.
The problem I am running into is for the IP range the former Domain 2 machines have been assigned the reverse lookup zone still is tied to Domain 2 and I am wondering how I can move it into Domain 1?

Domain 1 is a Windows 2008R2 Domain and Domain 2 is a Windows 2003R2 Domain.

Some background info:
Domain 2 was a turnkey solution from a vendor - so the domain/application was dropped into the environment way before my time.  Recently we did a hardware refresh with the vendor and during that process  the new servers were joined to domain 1.  The only thing was we needed to use the same IP addresses.  So the DC/App server IP addresses of Domain 2 were reused for the new App servers that were joined to Domain 1.  So Domain 2 DCs were re-ip'd and currently sitting idle as we have confirmed the app/hw refresh went well now I just need to finish the cleanup.  


Let me know if any other details are needed.

thanks in advance
0
Comment
Question by:EA-170
  • 7
  • 6
  • 2
15 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 167 total points
ID: 39613832
You can use the DNSCMD to accomplish this. You can export the Zone from domain B and import the Zone into Domain A. You can also use the registry to do this as well. See link below for more details on how to accomplish this.

Export/Import DNS Zone - http://tech.avivo.si/2011/02/importexport-dns-zones-from-dns-manager-in-windows-2008-r2/

Another helpful link...
http://robiulislam.wordpress.com/2012/01/11/windows-dns-export-import/

Will.
0
 
LVL 5

Assisted Solution

by:talkinsmak
talkinsmak earned 333 total points
ID: 39613857
You could export the PTRs using the DNS mmc and then use that information to bulk create the new records on your 2008 server using the steps in this blog:

http://kpytko.pl/2012/08/12/dns-bulk-ptr-records-creation/

I would use the DNScmd section.

Hope that helps.

John
0
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39613937
Basically what i just said isn't it?
0
 
LVL 5

Expert Comment

by:talkinsmak
ID: 39613944
LOL, Yes but your comment wasn't posted when I went to answer.

You were first, the OP will see that.

John
0
 

Author Comment

by:EA-170
ID: 39614089
thanks for the replies

I guess I have a clarification - so the domain 1 AD -DNS has a reverse lookup zone for the IP range but there is nothing in it other than the original NS from domain 2.  Just want to make sure doing the export and import won't cause any issues....
0
 
LVL 5

Expert Comment

by:talkinsmak
ID: 39614098
It should just create the new records and not disturb any existing records.

Does that address your concerns?

John
0
 

Author Comment

by:EA-170
ID: 39614134
So when I try to add domain 1 NS to the zone I get the server with this IP address is not authoritative for the required zone.  Will doing the export and import give domain 1 authoritative access to the zone?  Sorry as I should have included this in the original info
0
 
LVL 5

Expert Comment

by:talkinsmak
ID: 39614194
Doing the export import will not give you authoritative access.  To get authoritative access you need to create a new zone on the server.

Are you trying to have domain1.local answer for domain2.local?  If so, you need to spoof domain2.local on domain1.local by creating a new primary zone.

Does that make sense?
0
 

Author Comment

by:EA-170
ID: 39614217
yea - I am not trying to have domain1 answer for domain2 as domain2 is going dormant.  But I just want to have domain 1 own the reverse lookup for the IP range that was originally only used for domain 2 and domain 2 still has an authoritative hold on the reverse lookup zone.

Domain 1 was setup as a secondary zone - should I just kill the secondary zone and then create a new reverse lookup zone?

Sorry DNS stuff gets me confused and a weak spot for me...



let me know if that got confusing
0
 
LVL 5

Expert Comment

by:talkinsmak
ID: 39614266
I am heading to a short meeting but if your export from domain2 looks like this:

10.3.0.107      Pointer (PTR)      livedata.domain2.local.      static
10.3.0.242      Pointer (PTR)      washfs-acs.domain2.local.      static
10.3.0.243      Pointer (PTR)      ffxp001.domain2.local.      static
10.3.0.58      Pointer (PTR)      washgis.domain2.local.      static
10.3.3.112      Pointer (PTR)      washmgt2.domain2.local.      static

You will have to change the data from computername.domain2.local to computername.domain1.local.

You will also need to create the reverse zone prior to importing the data.  In my example you would create a reverse zone 10.3.0 (or X.0.3.10)
0
 

Author Comment

by:EA-170
ID: 39614336
after looking through the data on the domain 2 - a lot of those records are stale and inaccurate.  I am thinking since there is only about 30 machines I am just going to manually add the PTR records manually.  this way only the active machines will be in there.

For clean up purposes what would be the best way to clean up the other domain 2 DNS associations in the forward and reverse lookup zones.
0
 
LVL 5

Accepted Solution

by:
talkinsmak earned 333 total points
ID: 39614375
Ok.  If it is only 30 systems I would just create them manually also.  as for cleanup, if the domain is useless and you do not have any computers or users logging into it you can just shut it down.  

If there is a trust between the 2 domains then you will want to end that trust relationship and then shut down the old domain controller.  

You really do not have to do anything but turn it off and destroy the hard drives (if you want to)

If you want to play around you could run dcpromo on domain2 dc and remove the domain controller role and then remove dns.

John
0
 

Author Comment

by:EA-170
ID: 39614382
Yea - due to the nature of the apps - they will just sit on the shelf until probably the next hardware upgrade from the vendor.

For the DNS cleanup I can just delete the secondary zones?
0
 
LVL 5

Expert Comment

by:talkinsmak
ID: 39614418
Yes, you can right click and delete them.  You may get  a warning that the zone creates data but you can either delete the data first then delete the zone or just leave them.  

If the server is getting turned off after you create the zones on the new domain controller you can just leave them.  If none of your computers are pointing to domain2 for DNS then it isn't hurting anything to leave them there.
0
 

Author Comment

by:EA-170
ID: 39614435
ok - you know how it goes - like to be pristine

but thanks for the help I will award both of you the points as you originally answered my question but John thanks for the additional followup
0

Join & Write a Comment

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now