1

I just encountered several hours worth of work trying to untangle DNS problems in my domain after I demoted a DC/DNS server (illustrated here WinXP using old DNS server IP even though changed in DHCP and on the box ).

There's a stupid group policy (dunno why, but I'll leave it) that was forcing the DNS servers; changed it however the clients can't access the domain (since the primary DNS is down -- why the hell won't windows try the secondary one that is working fine?!?!?)... So how can I force either a group policy override (so that the desktops can find the domain again) or somehow get the group policy back on their computers? Ugh...

I see in there we have the IPs of both DNS servers and then two of our ISP's DNS servers.

The question is -- in an environment where DHCP is handling giving out DNS entries should one override that with DNS from the group policy? Although it burned me here after well-documenting it there shouldn't be a problem in the future -- but I'm left wondering if the policy should stay or go? Are the two IPs of the ISP DNS servers significant (the DNS servers on each DC are set up to forward to those IPs anyway)? Will the clients ever need them?

4 Answers 4

8

Best practices = no, do not apply via a GPO.

DHCP will forward requests to a handful of DNS servers of your choice. DNS will then forward requests out.

The use of GPO for defining DNS servers is usually if you want to apply special settings to particular workstations (based on GPO scope, machine/user memberships). An intranet test machine. An even better example is locking users out of the internet. If a user is a member of Deny_Internet security group, and you define this as a scope for a Set_Bogus_DNS GPO, then users that are a member of that group will not be able to surf the internet because they will not be able to resolve any addresses.

The drawback with the defining external DNS servers is that in the case of a major virus/worm outbreak, you have no way of locking out the offending domains. With DHCP pointing your machines to the internal DNS servers, if you needed to, you could lock www.malware-spreading-site.org by creating the DNS Primary Zone on your own DNS boxes, and point www to 127.0.0.1.

In summary, pointing internal machines to external DNS is bad. Bad bad bad. Naughty. Secondly, using DHCP is better than GPO in this case.

5
  • 4
    +1 for saying "...external DNS is bad." Assigning DNS servers with Group Policy is perverse and wrong, too. Jun 29, 2009 at 23:40
  • I agree - although there is a time and place for it - this isn't it!
    – Izzy
    Jun 29, 2009 at 23:42
  • I'm convinced. Group policy override destroyed!!! Jun 29, 2009 at 23:50
  • The point about external DNS is a good one, but you underestimate the use of GPO-defined DNS.
    – sh-beta
    Jun 30, 2009 at 0:21
  • 1
    +1 for DNS defined via DHCP. Used it for a few years now and it's 100% spot on, has saved us grief twice, and is nearly fire-and-forget. Jun 30, 2009 at 2:58
2

I see two real questions in your post:

Is assigning external DNS servers to domain clients a bad idea?

Yes. It is.

DNS is absolutely critical to Active Directory functioning correctly, and clients sending DNS requests out to external servers will cause problems sooner or later. It can help if your internal DNS is unstable, but if that's the case you have bigger problems than users unable to browse the web.

At most this should be used as a temporary bandaid while fixing your internal DNS. And bandaids should never be left on longer than they need to.

Is defining DNS servers via GPO a bad idea?

No. I'd actually recommend it.

There are a lot of reasons why defining DNS servers via GPO can be a very good idea:

  • It ensures consistency across your environment
  • It gives manageable granularity (manually modifying DNS per-server is not manageable, DHCP does not give proper granularity) for config differences
  • You can make environment-wide changes very quickly, without your users having to renew their DHCP leases
  • It allows you enforce policies/bandaids/hacks (like split-horizon DNS) without your users (un)intentionally bypassing them
  • It gives YOU control

In a simple environment this may be more trouble than it's worth. But if you have a domain, you're probably beyond that point already.

4
  • I don't buy the arguments. To respond to your points: 1) You can have consistency via DHCP options. 2) You can use DHCP reservations and options to specify different DNS servers for individual computers. 3) Plan in advance for such changes and you don't need to worry about DHCP leases expiring. DNS servers should be moving around at a moment's notice!. After all, it's an infrastructure service. 4) This implies users have "Administrator" rights. GPO's are no more "powerful" than DHCP options in that situation. I have yet to ever see DNS servers specified in GPOs in any real-life environment. Jun 30, 2009 at 0:44
  • 1) Yes, but then either your servers are getting their DNS via DHCP (less robust) or you have them manually configured (less manageable). 2) Also true, but I want to manage groups of computers, not individual computers. As an environment grows, this will lead to inconsistency. 3) Planning in advance doesn't reduce the time it takes to actually make the change. Deploying via GPO takes less time than DHCP from start to finish. Less time devoted to a simple change. 4) Bypassing GPOs requires more knowledge than bypassing DHCP options. It's imperfect but better enforcement.
    – sh-beta
    Jun 30, 2009 at 0:57
  • 1
    What everyone has neglected to mention is that you can have all the GPOs in the world, but the machine will STILL get its DNS settings from DHCP BEFORE GPOs apply to the connection. 1) Network connection fires up 2) DHCP found, apply DNS settings from DHCP 3) Resolve DC IP address 4) GPO applies, and changes DNS settings If the machines are hitting the DHCP defined DNS servers first, why argue - set them at the DHCP level instead of defining them twice. Defining, then defining over the top - not clean, unless you have a really good (and unique) reason to treat some machines differently
    – Izzy
    Jun 30, 2009 at 4:06
  • The only time I've ever seen a real use for defining DNS servers in GPOs is when a unix environment ran DHCP and it was essentially a seperate namespace from windows (DNS was borked so it didn't want to forward correctly) so a GPO pointed it to a windows DNS server.
    – Jim B
    Dec 28, 2011 at 16:15
2

As you've already found, using Group Policies to assign DNS is generally a bad idea. There's just too much to go wrong and debugging can be a nightmare. Under normal circumstances it shouldn't be necessary. If it is necessary it's probably time to take a good hard look at the entire network configuration to determine why it's necessary and see if it may perhaps be more appropriate to make changes elsewhere.

1

I give you a simple good reason too use GPO to define DNS settings. In a multiple and dynamic server environment, all servers have a static IP settings. GPO overwrite these, DHCP does not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .