AD & Dynamic DNS Updates Registration Rules of engagement

Keep in mind, for the most part it automatically works "out of the box" without much administrative overhead.

Original Compilation: 11/19/2012

===

Summary

1. The machine’s DNS entries in the NIC, must be ONLY configured to use the internal DNS servers that host the zone. No others.
    a. DHCP Option 006 MUST only be the internal DNS server(s) you want to use, otherwise if using an ISP’s DNS or your router, expect undesired results.

2. The Primary DNS Suffix on the machine MUST match the zone name in DNS.
    a. For joined machines, this is default.
    b. For non-joined machines, it must be manually configured or scripted.

3. If using DHCP Option 015 (Connection Specific Suffix), it must match the zone name and have "Use This Connection’s DNS Suffix in DNS Registration" along with "Register This Connection’s Addresses in DNS" checked in the NIC’s IPv4, Advanced, DNS tab.

4. The Zone must be configured to allow updates.

5. For AD Integrated Zones and Secure Only Updates:
   a. If the machine’s DNS is statically configured:
      – It must only point to the internal DNS
      – It must be joined to the domain in order to authenticate using Kerberos to update.
   b. If statically configured and not joined to the domain, the client can’t update if the zone is set to Secure Only.
   c. For non-joined domain DHCP clients, you can configure DHCP to update in lieu of the client updating into a Secure Only zone.

6. For any non-Windows statically configured machine, it must support the DNS Dynamic Updates feature and the zone configured to allow Secure and Unsecure updates.

7. If the DNS server is multihomed and not configured properly to work with multihoming, it may cause problems with Dynamic Updates.

8. If the zone is single label name, such as ‘domain’ instead of the proper minimal format of ‘domain.com,’ ‘domain.net,’ etc., it will NOT update.

9. The client will "look" for the SOA of the zone when it attempts registration. If the SOA is not available or resolvable, it won’t register. Keep in mind with AD integrated zones the SOA rotates among the DCs because of the multimaster feature. This is default and expected behavior, but if there are any DCs that have any problems, and the client resolved the SOA to that DC, it may not accept the update.

10. The zone in DNS must NOT be a single lable name, such as "DOMAIN" instead of the required minimum of two hierarchal levels such as domain.com, domain.local, domain.me, domain.you, etc. Single label name zones are problematic, do not conform to the DNS RFC, and causes excessive internet traffic to the Root Servers when DNS tries to resolve a single label name query, such as querying for computername.domain – in such a query, the domain name is actually treated as a TLD. ISC has made a note of the excessive traffic generated by Microsoft DNS servers configured with a single label name in 2004 with Microsoft, which in turn disabled the ability for Microsoft DNS in Windows 2000 SP4 and newer to resolve single label names without a registry band aid. More info on this:

Active Directory DNS Domain Name Single Label Names – Problematic
Published by Ace Fekay, MCT, MVP DS on Nov 12, 2009 at 6:25 PM  641  0
http://msmvps.com/blogs/acefekay/archive/2009/11/12/active-directory-dns-domain-name-single-label-names.aspx

11. For Windows 2008 and all newer operating systems, IPv6 must not be disabled. If disabled, it will cause other problems:
The Cable Guy – Support for IPv6 in Windows Server 2008 R2 and Windows 7, by Joseph Davies, Microsoft, Inc.
Quoted by Joseph Davies, MSFT:
"IPv6 is a mandatory part of the Windows operating system and it is enabled and included in standard Windows service and application testing during the operating system development process. Because Windows was designed specifically with IPv6 present, Microsoft does not perform any testing to determine the effects of disabling IPv6. If IPv6 is disabled on Windows Vista, Windows Server 2008, or later versions, some components will not function. "Moreover, applications that you might not think are using IPv6—such as Remote Assistance, HomeGroup, DirectAccess, and Windows Mail—could be."
http://technet.microsoft.com/en-us/magazine/2009.07.cableguy.aspx

Arguments against disabling IPv6
Demoire, [MSFT], 24 Nov 2010 12:37 AM
http://blogs.technet.com/b/netro/archive/2010/11/24/arguments-against-disabling-ipv6.aspx

Full explanation:

1. Active Directory’s DNS Domain Name is NOT a single label name ("DOMAIN" vs. the minimal requirement of "domain.com." "domain.local," etc).

2. The Primary DNS Suffix MUST matches the zone name that is allowing updates. Otherwise the client doesn’t know what zone name to register in. You can also have a different Connection Specific Suffix in addition to the Primary DNS Suffix to register into that zone as well.

3. AD/DNS zone MUST be configured to allow dynamic updates, whether Secure or Secure and Non-Secure. For client machines, if a client is not joined to the domain, and the zone is set to Secure, it will not register either.

4. You must ONLY use the DNS servers that host a copy of the AD zone name or have a reference to get to them. Do not use your ISP’s, an external DNS address, your router as a DNS address, or any other DNS that does not have a copy of the AD zone. Internet resolution for your machines will be accomplished by the Root servers (Root Hints), however it’s recommended to configure a forwarder for efficient Internet resolution. .

5. The domain controller is multihomed (which means it has more than one unteamed, active NIC, more than one IP address, and/or RRAS is installed on the DC).

6. The DNS addresses configured in the client’s IP properties must ONLY reference the DNS server(s) hosting the AD zone you want to update in.

This means that you must NOT use an external DNS in any machine’s IP property in an AD environment. You can’t mix them either. That’s because of the way the DNS Client side resolver service works. Even if you mix up internal DNS and ISP’s DNS addresses, the resolver algorithm can still have trouble asking the correct DNS server. It will ask the first one first. If it doesn’t get a response, it removes the first one from the eligible resolvers list and goes to the next in the list. It will not go back to the first one unless you restart the machine, restart the DNS Client service, or set a registry entry to cut the query TTL to 0. The rule is to ONLY use your internal DNS server(s) and configure a forwarder to your ISP’s DNS for efficient Internet resolution.

This is the reg entry to cut the query to 0 TTL (normally this is not necessary, but I’m posting it as a reference).

The DNS Client service does not revert to using the first server …The Windows 2000 Domain Name System (DNS) Client service (Dnscache) follows a certain algorithm when it decides the order in which to use the DNS servers …
http://support.microsoft.com/kb/286834

The DNS Client Service Does Not Revert to Using the First Server in the List in Windows XP (applies to all Operating Systems, too)
 http://support.microsoft.com/kb/320760

For more info, please read the following on the client side resolver service:

DNS, WINS NetBIOS & the Client Side Resolver, Browser Service, Disabling NetBIOS, Direct Hosted SMB (DirectSMB), If One DC is Down Does a Client logon to Another DC, and DNS Forwarders Algorithm if you have multiple forwarders.
http://msmvps.com/blogs/acefekay/archive/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-logon-to-another-dc-and-dns-forwarders-algorithm.aspx

7. For DHCP clients, DHCP Option 006 for the clients are set to the same DNS server.

8. If using DHCP, DHCP server must only be referencing the same exact DNS
server(s) in it’s own IP properties in order for it to ‘force’ (if you set
that setting) registration into DNS. Otherwise, how would it know which DNS
to send the reg data to?

9. If the AD DNS Domain name is a single label name, such as "EXAMPLE", and not the proper format of "example.com" and/or any child of that format, such as "child1.example.com", then we have a real big problem. DNS will not allow registration into a single label domain name.
This is for two reasons:
       1. It’s not the proper hierarchal format. DNS is
           hierarchal, but a single label name has no hierarchy.
           It’s just a single name.
       2. Registration attempts causes major Internet queries
           to the Root servers. Why? Because it thinks the
           single label name, such as "EXAMPLE", is a TLD
          (Top Level Domain), such as "com", "net", etc. It
          will now try to find what Root name server out there
          handles that TLD. In the end it comes back to itself
         and then attempts to register. Unfortunately it doe NOT
         ask itself first for the mere reason it thinks it’s a TLD.

(Quoted from Alan Woods, Microsoft, 2004):
"Due to this excessive Root query traffic, which ISC found from a study that discovered Microsoft DNS servers are causing excessive traffic because of single label names, Microsoft, being an internet friendly neighbor and wanting to stop this problem for their neighbors, stopped the ability to register into DNS with Windows 2000 SP4, XP SP1, (especially XP,which cause lookup problems too), and Windows 2003. After all, DNS is hierarchal, so therefore why even allow single label DNS domain names?"

The above also *especially* applies to Windows Vista, Windows 7, &, 2008, 2008 R2, Windows 2012, and newer.

10. ‘Register this connection’s address" on the client is not enabled under the NIC’s IP properties, DNS tab.

11. Maybe there’s a GPO set to force Secure updates and the machine isn’t a joined member of the domain.

12. With Windows 2000, 2003 and XP, the "DHCP client" Service is not running.  In Windows 2008, Windows Vista and all newer operating systems, it’s now the DNS Client Service. This is a requirement for DNS registration and DNS resolution even if the client is not actually using DHCP.

Dynamic DNS Updates Do Not Work if the DHCP Client Service Stops (2000/2003/XP only)
http://support.microsoft.com/?id=264539

13. You can also configure DHCP to force register clients for you, as well as keep the DNS zone clean of old or duplicate entries. The following has more information on how to do that:

DHCP, Dynamic DNS Updates, Scavenging, static entries & timestamps, and the DnsProxyUpdate Group (How to remove and prevent future duplicate DNS host records)
Published by acefekay on Aug 20, 2009 at 10:36 AM  3758  2 
http://msmvps.com/blogs/acefekay/archive/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group.aspx

 

What will stop AD SRV registration:

1) External DNS servers are configured under TCP/IP properties.  Only use internal DNS servers when part of an Active Directory domain.  AD Domain machines must ever be pointed at an external (ISP) DNS server or even use an ISP DNS server as an "Alternate DNS server".

2. Are any services disabled such as the DHCP Client service? (it’s required).

No DNS registration functions if DHCP Client Service Is Not Running (2000/2003/XP only)
http://support.microsoft.com/?id=268674

Dynamic DNS Updates Do Not Work if the DHCP Client Service Stops (2000/2003/XP only)
http://support.microsoft.com/?id=264539

For all Windows 2008, Windows Vista and all newer operating systems, it’s the DNS Client Service.

3. The AD/DNS zone not configured to allow dynamic updates.

4. Make sure ‘Register this connection’s address" in DNS is enabled under TCP/IP properties.

5. Missing or incorrect "Primary DNS suffix" or "Connection-specific DNS suffix" of the domain to which the machine belongs.  With a missing/incorrect DNS suffix a machine cannot find the correct zone to register in. If missing or incorrect, it is called a Disjoined Domain Name.

6. Is the firewall service enabled? (disable it).

7. Were the default C: drive permissions altered and was a hotfix installed a recently?

"Systems that have changed the default Access Control List permissions on the
%windir%\registration directory may experience various problems after you
install the Microsoft Security Bulletin MS05-051 for COM+ and MS DTC"
http://support.microsoft.com/kb/909444

For more info about this issue, see:
http://blogs.technet.com/steriley/archive/2005/11/08/414002.aspx

8. If using Secure Updates: Not authenticated to the domain (which can be due to DNS misconfiguration or DNS server problem)

9. Is the File and Print services enabled?

10. Microsoft Client Services enabled?

11. Is DNS listening on the private LAN interface?

12. More than one NIC?

13. Updates allowed on the zone?

14. Primary DNS suffix matches the zone name in DNS and the AD domain name?

15. Was Zone Alarm ever installed on these machines?

16. Any Event log errors?

17. Was a Registry entry configured to stop registration?
246804 – How to Enable-Disable Windows 2000 Dynamic DNS Registrations (per NIC too):
http://support.microsoft.com/?id=246804

18. Spyware or something else such as DotNetDns installed on it?

19. Single Label Domain Name?

20. Netlogon and DFS services are started.

21. Malware or virus altering network services preventing it from registering.

22. Some sort of firewall in place, whether the Windows firewall disabling File and Print Services, or a 3rd party firewall, which many AV programs now have built in and must be adjusted to allow this sort of traffic and exclude the NTDS and SYSVOL folders. If Windows Firewall, run the following to see what settings are enabled:
netsh firewall show config

23. Is IPv6 disabled? That will stop registration. Enable it.

 

Suggestions, Comments, Corrections are welcomed.

Ace Fekay, MCT, MVP Directory Services

One Reply to “AD & Dynamic DNS Updates Registration Rules of engagement”

Leave a Reply