Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have AD on 2008R2 implemented and working fine. We have ONE Forest and 3 child domains city1.domain.lan, city2.domain.lan, city3.domain.lan with rootdc.domain.lan being the forest master. Forest functional level is Windows 2003.

I have recently inheritted this setup and my initial findings reveal that the child domains are not resolving DNS name lookups for external requests, rather the previous sys-admin was distributing DC IPADDRESS, and as DNS servers.

There are no forwarders configured on the DC DNS MMC, moreover the DC cannot browse the internet due to security reasons, they have a VPN tunnel connected to root site for replication but all other traffic is disabled on that circuit - so no internet connectivity for the DC itself - hence no external DNS lookups.

As they have around 500 - 700 Users and considering everyone is getting and for external dns lookups, I am thinking that would be a lot of requests going out there Internet Link for DNS (53).

Q1 - Do you think I should implement a windows based DC joined to the child domain for external look ups or the above setup seems ok?
Q2 - What do I look for to verify whether the DC is replicating fine (repadmin ?)
Q3 - I checked Sites and Services but I am not very good in AD and have to learn - so would be grateful if you could let me know what to look for ?
Q4 - I used AD topology diagrammer and it says Intersite Replication disabled ? Is this harmful ?

I will post more details about the AD topology and if one could let me know what to provide as info - I will do my best to get the question updated ASAP

Your help would be grately appreciated
Thanks !!

share|improve this question
up vote 2 down vote accepted

Q1 - My suggestion would be to setup caching DNS servers (Windows or bind) that is used ONLY for external lookups in your DMZ so your setup would look like:

Client -> DC -> DNS server in DMZ -> interwebs

Q2 - Check out dcdiag, also the DC event logs and DFS event logs

Q3 - Not sure what you are asking here

Q4 - yes, if your domains arn't replicating between sites then you can and will have conflicts. However, if you only have one site ... well then it's not a problem.

share|improve this answer
Hi Zypher, Thank you for your prompt response, I meant to ask on Q.3 that what shall I look for in Sites and Services MMC. Also, as per our network team there is a site to site vpn to root site and dc replicate, but if I try to open / browse the root-dc, i am unable to do so. We have 4 Sites with Master site in another city. – rihatum Jul 19 '11 at 19:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.