AD Intergrated DNS Questions

Currently, we are still in traditional DNS (Primary/Secondary) . DNS Service is on all DCs in Forest (Single Domain). Looking to migrate to AD Integrated.
In order to convert to AD integrated it seems I just have to click on is "Store the Zone in Active Directory".

1) Above Correct? No Prerequisites needed?
2) Does it automatically create the DNS AD Partition?
3) Do I have to do the same on all the Secondary DNS Servers?
4) What is the best method to Post-test replication?
5) What is the logic in AD DNS if Computer from different AD Site needs to register a DNS update?
6) If AD intergrated DNS, is there still such thing as “Primary”?
GGHCAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

GGHCAuthor Commented:
So I took the Leap of Faith and enabled it.
First got this error. Restarted DNS Service.. Doesn't seem anything is broken though. Best way to test?
BTW AD Forest is 2008 | Primary DNS is 2008 DC | Most other DCs are 2016


Dns Error
After reviewing the Secondary DNS, these are not part of AD Integrated. Is this correct? Are there any actions/tweaks needed?
DNS Primary and Secondary
0
MaheshArchitectCommented:
you already have all prerequisites to run ad integrated dns
just delete secondary zones from all servers and then convert your standard primary zone to ad integrated
it will automatically create required application directory partition to host dns data in active directory
change zone replication scope to "all dns servers in this domain"
wait for some time for ad replication and zone should appear on all dc servers where dns role is installed

also go to zone properties and ensure that zone is set to dynamic update
this will take care of dns records registration
0
MaheshArchitectCommented:
lastly make sure that you will do all configuration through domain admins
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

MaheshArchitectCommented:
Actually you have asked two many questions in one GO, I forgot to answer those:

There is no primary and secondary for Ad integrated zone
All zone copies are writable copies and it is called as AD integrated zone because zone data is stored in AD and if you made any change in zone on any one server, changes will get replicated to all servers (zone copies on other servers)
The above method you can use to test if zones are working correctly

I think I have covered rest of all questions in earlier post
0
GGHCAuthor Commented:
Thanks Mahesh.
After a restart of each DCs all the DNS secondary converted to AD Integrated! :)

However when I try to set the “Replication” in General Tab from “All Domain Controllers..” to “All DNS Servers in this Domain..” I get the error “The replication scope could not be set”... Same screenshot earlier in thread.

As per search.. I did already check the Default Domain Controller GP....Administrator on Manage auditing and Security log.

Any idea what else to check/test?
0
MaheshArchitectCommented:
The below could be your issue:
To resolve this issue, you must add the built-in administrators group account to the manage auditing and security log user permission. The manage auditing and security log user permission is located in the default domain controller policy.

https://support.microsoft.com/en-us/help/842560/you-cannot-change-the-replication-scope-of-an-active-directory-integra
0
GGHCAuthor Commented:
Thats the setting that I already tried. I even removed and readded... still no luck.

I must mention the DomainDNSZones & ForestDNSZones contains old stale entries and pretty empty... nothing new/current???
0
GGHCAuthor Commented:
Also want to mention that as a test I modify a test Host record, it “eventually” updates on other DNS servers. AD replication test are immediate even across Sites (I have no schedule setting set).

I can’t find the DNS under Adsi\Configuration
0
MaheshArchitectCommented:
point dc to itself as preferred dns and another dc as alternate in network properties and restart net logon service on each dc and check if entries r getting updated

also if you could run "dcdiag /v" from PDC server and post output here?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
GGHCAuthor Commented:
The Error still does exist (But no impact in prod). Good guidance was given by Mahesh. Thanks!!!!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.