Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hope everybody had a good July 4th!

Looking through my DNS entries, I see the following:

enter image description here

My questions are:

  1. How do I identify which of these belongs to the current domain?
  2. Is it safe to delete the rest of them or should I just leave them all alone? Is there any harm done in keeping them?
  3. How are these ids generated?

The reason I'm asking these is because I have had to rebuild Active Directory on a domain controller a few times and have had to use the same name. What I've been left with is a single _ldap record of that domain controller inside the _tcp record for every one of those entries. I suspect that some of these are remnants of that process and I'm trying to cleanup stale records. I've tried scavenging but they persist.

Thank you.

share|improve this question
up vote 5 down vote accepted

Those entries are for programmatic lookup of your domain controllers by processes which have and use the GUID. This provides a consistent DNS location to point to, which is useful when, for instance, the name of the domain changes.

The entries there will match the objectGUID property on each of your domains, which you can check and compare via ADSI Edit (the domain root object contains this property, the top DC object when you connect to the default context).

Keep in mind that this container is for the entire forest; every domain in the tree has an entry in there. If an entry matches none of your current domains, it's safe to delete.

share|improve this answer
Thank you Shane. – Bourne Jul 5 '11 at 23:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.