Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Change DNS zone to "secure only" dynamic update

Posted on 2014-03-17
4
Medium Priority
?
557 Views
Last Modified: 2014-03-24
Hi All

I have a forward look up AD integrated zone (main one for my organization) which is currently set to "Non secure and secure" dynamic updates in DNS (Server 2008 R2). We have enabled "Name protection" in DHCP to prevent rouge devices taking over important server names but this requires DNS to be set to Secure only dynamic updates.

My question is can this be done without any distruptions? Will the existing records in DNS still be there? Will DHCP still be able to update DNS for domain computers? I can manually add the non domain ones to DNS. Can someone confirm that my intended change will not get rid of the exisitng records and cause more headaches. Thanks
0
Comment
Question by:nassr101
4 Comments
 
LVL 38

Accepted Solution

by:
Mahesh earned 750 total points
ID: 39936942
Nothing will be impacted at all

This is what needs to be done in case of AD integrated Zones

Also ensure that your DNS-DHCP integration is set perfectly according to below EE articles
http://www.experts-exchange.com/Networking/Protocols/DNS/Q_28379478.html
http://www.experts-
http://www.experts-exchange.com/Networking/Protocols/DNS/Q_28361151.html
http://www.experts-exchange.com/Networking/Protocols/DNS/Q_28376098.html

Please check my comments in above articles

Mahesh
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 39937169
My question is can this be done without any distruptions?
There shouldn't be any disruption if you're not deleting records that already exist.

Will the existing records in DNS still be there?
Yes, only manual deletion or the DNS scavenging task does any deletions from the DNS zone.

Will DHCP still be able to update DNS for domain computers?
Yes, but only if the DHCP server has permissions to update those records.
You need to remember (in AD2008) that when you enable AD-integration on DNS zones then the default is set to "enable secure updates." You also need to remember that the permissions on DNS records in AD integrated zones are like any other AD object. If the user or system has permissions to update a record then it will. If the user/system does not have any permissions then the record cannot be updated.

I can manually add the non domain ones to DNS. Can someone confirm that my intended change will not get rid of the exisitng records and cause more headaches. Thanks

Some useful links about DHCP and DNS
http://technet.microsoft.com/en-us/library/cc771732.aspx
http://technet.microsoft.com/en-us/library/ee941150(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc732584.aspx
0
 
LVL 27

Expert Comment

by:Steve
ID: 39937249
secure DNS updates just restricts who/what can make changes.
Domain joined PCs and your existing AD approved DHCP servers are included so shouldn't be affected.

Non secure & secure updates is normally enabled if you have other devices on site that may nee to make DNS changes, but are not Windows domain based machines (eg routers, printers etc)

Most companies are fine on secure only. It makes no changes and doesn't stop anything working on your existing network. The only real issue occurs if you do have non-windows systems that are trying to make DNS changes (eg DHCP on a router)
0
 

Author Closing Comment

by:nassr101
ID: 39952407
Thanks Mahesh. I changed the zone type yesterday and it went smoothly
0

Featured Post

Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows Server 2003 introduced persistent Volume Shadow Copies and made 2003 a must-do upgrade.  Since then, it's been a must-implement feature for all servers doing any kind of file sharing.
How to fix a SonicWall Gateway Anti-Virus firewall blocking automatic updates to apps like Windows, Adobe, Symantec, etc.
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

782 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question