DNS cannot be installed on this DC because this DC does not host DNS

Posted on 2014-01-13
Last Modified: 2014-01-23
Hello EE,
I have a DC that I am trying to introduce into my existing child domain.
Parent domain has 2 DC's
Child domain has 6 DC's (one per branch office)

I have a 2003 functional level and am trying to replace the 2003 with 2012.  I have 2 DCs in with 2012 as of now, but am trying to add another and get that going along side my 2003 and eventually demote the 2003, but when I run the promote wizard it gives me greyed out DNS.
"DNS cannot be installed on this domain controller because this domain does not host DNS"
What is this?  I've read other articles but not matching my environment so not sure what to do ?
Question by:bergquistcompany
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 5
  • 2
  • +2
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39777649
Do you have the DNS server role installed on your DC brfore doing the promotion? Have you tried to add ADDS and DNS from the Roles, then do dcpromo /adv.

From there try again and see if you get the same error.

You can also reference the below link. It describes 2008R2 but same concept applies.

LVL 34

Expert Comment

by:Paul MacDonald
ID: 39777654
Microsoft suggests completing the installation, then installing DNS once you've rebooted.

Author Comment

ID: 39778253
DNS and AD DS roles have been installed.  Now at the promote part.

Should I uninstall DNS, leaving AD DS, promote and then install DNS?
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 34

Expert Comment

by:Paul MacDonald
ID: 39778278
You should be able to promote the DC with DNS installed.  Give it a go.  If it doesn't work, fall back to promoting it, then setting up DNS.
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39778281
Do the promotion. Make sure that the your DC is initially pointing to another DC until it has been fully promoted. Once promoted and DNS is installed make the primary DNS server point to itself.

LVL 26

Expert Comment

ID: 39779947
Your AD domain doesn't have a single-label DNS name (i.e., a name like contoso rather than, contoso,local, or something like that), does it?
LVL 37

Expert Comment

ID: 39783793
This problem occurs only in child domain if DNS is not setup properly between parent and child domain
If parent DNS and child dns are out of sync, then during DC promotion, you cannot identify its authoritative zone (child domain DNS zone) and that's why DNS is getting grated out.
Let us know if you have Something like below
You have parent domain called having replication scope to all domain sin forest
Your child domain must be having, but with replication scope to all dns servers in this domain due to some zone deletion, restoration in past. There is zone in both domains but totally out of sync

In that case this is not ideal situation and child domain simply unable to find its authoritative zone registration in AD and DNS is greyed out.


Author Comment

ID: 39785418

Parent domain is and there are 2 DCs in this domain.  How can I confirm if they are replicating to all domains in forest or just in domain?
Child is and these domains replicate within the domain I believe.

How can I confirm/correct this?

I did promote and I it has DNS entries so is there a way to confirm
LVL 37

Expert Comment

ID: 39786107
You can go to zone properties \ general tab \ replication and check what is selected there ?

All dns servers in domain or all dns servers in forest. Will tell you there replication scope

parent domain zone should replicated to all dns servers in its own domain only and child also should replicate to its own domain only as a best practise.

What is your name resolution strategy between parent and child domains ?

Check if you have created domain dns delegation on parent DC in parent domain dns zone pointing to child domain and its DC and it do not contains any stale NS records for child DNS servers as DNS delegation is static and NS records need to be manually updated when changed.
Parent domain should have dns delegation pointing to child domain dns server to resolve resources in child domain from parent domain and child domain must be having conditional forwarder on its dns server pointing to parent domain for resolving records in parent domain
Alternatively you can setup secondary zones in both domains pointing to each other for name resolution
Just check with nslookup if both domain DCs can resolve each other.
Just run below commands on both domains DNS server to verify if both can resolve each other.
In cmd Type nslookup, and then press ENTER.
Type set type=all, and then press ENTER.
Type _ldap._tcp.dc._msdcs.Domain_Name,
Change domain name with parent domain and child domain respectively and it should resolve properly

if everything is setup as per above then you should not get dns greyed out


Author Comment

ID: 39786634
So I show on Parent:
Type AD Integrated
Replication: All DNS servers in this forest.  Should change this?
Child domain doesn't have properties to check (See attached)

parent is
child is

How do I confirm delegation settings?  No Zone transfers and Name servers for all DCs listed.
Parent preferred is self and alternate child
Secondary Parent DC is self as preferred and primary parent DC as alternate
I have nothing in conditional forwarders folder (see attached)

so from child nslookup parent domain and vice versa?
LVL 37

Expert Comment

ID: 39786691
Please don't change anything right now.
Yes, you have single zone replicated to parent and child domain
That is why you don't have conditional forwarders in child domain and delegation in parent domain as complete zone is replicated to both domains.

Yes, please do nslookup from child and parent for each other as mentioned in earlier comment for verification.

Can you just check zone properties on child DC (go to properties of main zone same as parent domain) and can you check there what is the replication scope please


Author Comment

ID: 39788319
Is how you are saying the best practice for DNS setup?

from parent DC
Address:  10.10.x.x


From child
Address:  10.10.x.x


If I go to DNS on the child and look at the parent domain properties it is the same AD integrated and to all DCs in the forest.  Again the child domain is a folder so can't go to properties on the child other than physically I am on the child dc now.

Thanks again for all your help!
LVL 37

Expert Comment

ID: 39788438
It looks like DNS is not according to best practises, but configuration is OK and no change is required as it will inolve some major changes \ steps \ downtime which is not advisable at this point of time.
I have observed that this DNS grayed out problem occcurs offen in child domains only

Just outline steps here:
Export all records in parent zone under child domain sub folder
Prepare dnscmd batch file (dnscmd /recordadd) for adding host A records in child domain in advance
Change parent zone ( replication scope from forest to domain !!
Above step will simply delete parent zone from all DCs in child domain -critical step
delete child domain folder from parent dns zone - Force AD replication in parent domain
create dns delegation in parent dns zone on parent DC pointing to child domain
Point child domain PDC to itself in tcp/ip settings - I guess it is already
create ad integrated zone in child domain PDC with replication scope as domain and ADD all child DC as NS records in that zone manually.
Restart netlogon service on child PDC to populate all DNS folders and SRV records in child domain to that zone
Force replication to populate that zone on all child DCs
Create conditional forwarder in child domain PDC pointing to parent domain and its DNS server and store it into active directory
Restore all Host (A) records for resources in child domain with dnscmd batch file created earlier

All above excercise required extreme care and involves downtime.

Above outlined steps actually need to be done at very intial stage when you 1st deployed child domain 1st DC in past.

2008 R2 AD is smart enough to identify this and it will automatiocally create delegation in parent zone on parent DC and create zone in child domain exactly same as stated above in 1st shot

Hence I suggest you to go with workaround provided by others and keep above in mind in case if you required to create additional child domains in feature


Author Comment

ID: 39789149
So based on nslookup it appears DNS is working on new child?

In future Promote then install DNS?  And your steps if creating other child domains but for the one I have I must continue as is?
LVL 37

Accepted Solution

Mahesh earned 500 total points
ID: 39789417
Yes, basically Nslookup is the primary tool to identify

Apart from that you have same zone replicated to all dns servers in forest and replication is working as well, so in this situation its not worth to change DNS architecture only for single issue

Separating DNS zones for  each domain have several benefits:
Each zone is replicated to in its own domain only
What it means, in existing architecture your whole child domain DNS folders unnecessarily getting replicated to parent domain causing utilizing more system resources.
Also any DNS issues \ stale records \ misconfigurations will remain limited to its own domain only
Also your organization size is big and if you have multiple domains, then there is no point in keeping single zone that will replicated to all domains as this zone is getting bigger day by day causing more system utilization for all domains.

Yes, in future first promote, then install DNS (Workaround)

Now if you want to change architecture, it will lead to downtime and it requires careful planning, probably you need to hire consultant to do that perfectly
That is why I suggested you to keep it as is.

Even if you now try to promote new 2008 R2 child domain, scenario will not change as your root domain dns zone is set to replicate in all dns servers in forest and hence separate child domain dns zone ( will never get created automatically.

The only option to do that is to restructure DNS in parent and child domains

Now you will ask me what if you create in existing child domain and later on get rid of replicated parent dns zone ?
Yes, you can do that, but moment you do that DNS dynamic update will start updating records in new zone only and your existing records that exists in child domain folder under parent zone on child DC will stop DNS dynamic update and this will create mess.
Because DNS dynamic update can work with any one zone only at a time and that make sense to avoid corruption.
The viable option in that situation is that you can export all records from child domain folder under parent zone on child DC 1st and once you created zone as above (, then use batch file (dnscmd /recordadd) to add those records to newly created zone and then delete them from child domain folder under parent zone on child DC
The force replication of newly created zone on all child DCs and once it get replicated to all servers, just go to parent domain and change parent zone replication scope to all dns servers in domain so that zone will get deleted automatically from child DCs
This will minimize impact and downtime.

This solution is not recommended by MS, but I have done it successfully for one of my client.

If you really want to do it, just hire some consultant


Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SBS 2008 to Server 2012 6 48
Azure AD / OAUTH 2 46
wannacry ransomware virus 2008R2 6 96
AD Computer Objects in VB .Net 2 21
This article runs through the process of deploying a single EXE application selectively to a group of user.
This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question