Changed DNS server target, now can't join domain. What gives?

[Patrick Coghlan]

I get the following error when I try to join one of our network domains:

Shell logo

Previously, we were using our own DCs for DNS, but subsequently used our
network's master DNS server (which does not allow write-access).

Is the problem we are having trying to join the domain related to the
fact that the DNS server does not allow write-access?

Thanks in advance.

-Pat

 

[Danny Sanders]

Previously, we were using our own DCs for DNS, but subsequently used our ?>network's master DNS server (which does not allow write-access).

Is the problem we are having trying to join the domain related to the fact that the >DNS server does not allow write-access?

Clients of an AD domain MUST find the SRV records that the AD DCs register in DNS. If your other DNS server does not allow write access, your AD DCs can't register the SRV records your clients MUST find in orfer to "find' the AD domain.


Either revert back using your DC for DNS, then set up the DC to forward requests and list the "network" DNS server as the forwarder, or get the DNS admin to add the proper records manually for the AD DCs.

Maybe you can get them to allow write access for ONLY your AD DCs?

The first suggestion may work best since you don't have to do *anything* to the network DNS servers.

hth
DDS W 2k MVP MCSE

I get the following error when I try to join one of our network domains:



Previously, we were using our own DCs for DNS, but subsequently used our network's master DNS server (which does not allow write-access).

Is the problem we are having trying to join the domain related to the fact that the DNS server does not allow write-access?

Thanks in advance.

-Pat

 

[Pat Coghlan]

Are you saying that we should run DNS on our DCs so that the SRV records
can be stored there, and point the workstations to our DCs for DNS, but
configure the DCs so that all name resolution lookups go to the master
server (transparently)?

Where is the menu to configure a DNS server to forward (non-SRV) lookups?

Thanks.

-Pat

 

[Danny Sanders]

Are you saying that we should run DNS on our DCs so that the SRV records

can be stored there, and point the workstations to our DCs for DNS,

Yes these are the records the AD clients MUST find.


but

configure the DCs so that all name resolution lookups go to the master
server (transparently)?

Where is the menu to configure a DNS server to forward (non-SRV) lookups?

Example your domain name is mydomain.com. When a client requests *anything*
(printing, files, website, etc) that is in the mydomain.com domain, the DNS
server knows it is authoritive for the mydomain.com zone and searches it's
zone for the requested resource.

When a client requests *anything* other than what is in the mydomain.com
zone (basically the entire Internet, and in your case, other DNS zones held
your "network" DNS server), those requests will get forwarded to your
network DNS server. It will resolve requests for *anything* in it's zones.
Not knowing what your "network" DNS is doing, I can only guess that if a
computer is pointed to the "network" DNS server it can get Internet access.

If this is true, any request the "network" DNS server can not answer
(basically the entire Internet) will get resolved via forwarding to an ISP
or root hints. You are not forwarding the SRV records, you are forwarding
requests for resources NOT held in the DNS server.

See:
http://support.microsoft.com/default.aspx?scid=kb;en-us;237675
for steps to setting up DNS for AD

See:
http://support.microsoft.com/default.aspx?scid=kb;en-us;300202
for setting up forwarding. You would forward to your "network" DNS server if
you wanted the users in the AD domain to access resources in the zones the
network DNS server holds, if not you could just forward to your ISP's DNS
servers.


hth
DDS W 2k MVP MCSE

 

[Pat Coghlan]

Good description re: resources held in the domain. Thanks.

I'm pretty sure our DNS admins are going to manually enter the SRV info,
since the servers aren't dynamic. I guess that's going to pretty much
make it impossible to share printers etc.

I'd like to investigate this forwarding issue a bit more. Under what
DNS menu is this configured?

Much obliged.

-Pat

 

[Danny Sanders]

From this link:
To Configure Forwarders
1. In DNS Manager, right-click the DNS Server object, and then click
Properties.
2. Click the Forwarders tab.
3. Click to select the Enable Forwarders check box.
4. In the IP address box, type the first DNS server to which you want
to forward, and then click Add.
5. Repeat step 4 until you have added all the DNS servers to which you
want to forward.



hth
DDS W 2k MVP MCSE