Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This may be a completely stupid question, but I'm really new to Windows Server 2003. If this is something I should be able to figure out on my own, just point me in the right direction. I have no idea where to start though.

Right, our domain controller, a Windows 2003 server, used to be set up as the primary DNS server for our network. I changed the primary DNS server to our router, thinking it would help the network, esp if the DC went down (which is used to do quite a bit). It's been working quite well. However, now if I try to join a new computer to the domain, it can't find the DC. If I manually change that computer's DNS server to the DC, then it works...

I have the domain controller's computer name as a static DNS entry in the router, but I'm guessing that I need more than that.

Again, feel free to just point me in the right direction.

Edit: Isn't there a way to mark a question as answered? Or maybe this one already is. Anyway, thanks for the help!

share|improve this question
if you have a second domain controller, you were likely having replication errors as well. My rule for debugging AD errors is this: 1) It's a DNS problem; and 2) if you decide it is not a DNS problem, refer back to rule #1 – uSlackr Jun 3 '11 at 14:24
System support is less stressful if you take the pledge to "first do no harm". That usually implies a lot of research before taking action. We can help with this in the future as can google, bing and technet – uSlackr Jun 3 '11 at 14:27
Thanks guys, I appreciate all of the help. I went ahead and changed it back to the DNS server. – umiwangu Aug 16 '11 at 16:01

Active Directory is entirely dependent on DNS to function properly. You should only be using AD DNS servers. You should change this back ASAP.

If you really wanted to offload this to another server, you'd have to mirror the _mcsds zone that's in your AD DNS server as well as all of the records for each server that hosts resources in your domain. This is still a very bad idea. DNS doesn't have a massive overheard, there's no reason to offload it.

Not to sound like a jerk, but this is very basic knowledge. You should start poking around technet and read everything that you can.

share|improve this answer
Well, he actually said "this may be a completely stupid question, but I'm really new to Windows Server 2003". – Massimo Jun 3 '11 at 14:22
You can make use of other DNS servers, BUT, you have to know what you are doing and you have to test it heavily before making any changes. – uSlackr Jun 3 '11 at 14:25
@Massimo, Yeah, I saw that. AD is central to a Windows infrastructure though. If you're new to it and you don't know what the consequences of making changes will be, then you shouldn't be making changes. – MDMarra Jun 3 '11 at 14:25
Thanks Mark, I've started poking around in Technet and it's been very helpful. – umiwangu Aug 16 '11 at 16:01

Active Directory relies heavily on DNS for its internal working, not only for mapping hostnames to IP addresses, but for a lot of domain functions, like finding a domain controller. Every AD domain corresponds to a DNS zone, and every computer in the domain needs to use DNS servers that fully know what is inside this zone; this is usually automatically configured on domain controllers which also host the DNS service (the first DC in a domain is also by default a DNS server).

In short, yes, you really should point all computers back to your DC, or the domain will not work correctly. If you want to resolve external names (i.e. Internet names) using other DNS servers, you can configure them as forwarders on your DC; but each and every domain-joined computer, including the domain controller itself, should use it and only it as its DNS server.

Lots and lots of information here.

share|improve this answer
Thanks Massimo! – umiwangu Aug 16 '11 at 16:01

Windows looks for Domain Controllers by querying for a DNS SRV record. When you pointed your primary DNS to your router, I'm willing to bet these records never got created - that's probably why new computers can't locate a Domain Controller. That aside, your Domain Controllers should always be your primary DNS servers - Active Directory relies heavily on DNS and you've probably got more things breaking that you don't even realise.

From How Domain Controllers Are Located in Windows XP (but relevant to all versions of Windows really):

When a client logs on or joins the network, the client must be able to locate a domain controller. The client sends a DNS Lookup query to DNS to find domain controllers, preferably in the client's own subnet. Therefore, clients find a domain controller by querying DNS for a record of the form LDAP._TCP.dc._msdcs.domainname

The bottom line is: Change DNS back to your Domain Controllers ASAP.

share|improve this answer

As MarkM stated in his answer, the DC and all AD joined computers should point to the DC\DNS server for DNS.

If you have a problem with the stability of the DC then the solution is to fix the DC, not to change the DNS settings.

share|improve this answer

Your domain controller does not need to be a DNS server however the DNS records that were stored on your microsoft DNS server have to be in place regardless of the dns server platform. If you were to replicate the dns over to the router (which is likely not a real DNS server) things would be fine provided clients could register with it. As other have stated put it back until you have a better idea of what is required for DNS to support active directory

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.