Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have just taken on a job as a new Sys Admin for a local small business. They have a very old DNS server (8 years old) running Windows server 2000. This server provides access for about 20 to 30 clients. We are wanting to upgrade to a new server, but before I do I was looking for a general overview of replacing an old DNS server as this will be my first time doing so. Obviously security is a must and I am familiar with using Active directory but have never setup from the beginning.

Specifically what I am looking for is:

  • What are some commonly missed security holes
  • Basic overview of what to do (or where to look for an overview)
  • Best practices for initial setup
share|improve this question

1 Answer 1

up vote 2 down vote accepted

Since that's 2000, its likely that the forward lookup domain for the AD tree itself is an Integrated zone. Adding that to a new server is as easy as DCPromo-ing up a new domain controller, adding the DNS service, and bringing it across. Then comes the fun of updating everyone's DNS settings (DHCP!).

Security wise, there are a few areas:

  • Restrict Zone Transfers. You want to restrict Zone Transfers to only the machines that need it. And if you only use AD-Integrated servers for serving DNS, you don't need to do it at all. We have BIND servers that we use as secondaries for our AD domain-DNS, so they're in our Zone Transfer list. You may not have any.
  • Restrict Dynamic DNS. Out of the box, AD allows (or did in 2000) unauthenticated Dymanic DNS updates. This is the most compatible option, but it does represent a major security hole. Turing this to "secure updates only" is strongly recommended.
  • Verify DNS Update permissions. Check the "Security" tab for your zones and make sure the permissions are set right. Who knows if what was set 8 years ago is still valid.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.