Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that this is best practice.

Is there any danger to scavenging the _msdcs zone?
Should I make it so that zone is not scavenged?
Could scavenging have broken anything in that zone that I'm unaware of at this time?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

OK, so, a quick rundown:

  1. _msdcs is essentially where all those AD-critical SRV records are kept.
  2. All your servers which need SRV records should be registering and refreshing them via dynamic DNS. You're (hopefully) not building your SRV records by hand.
  3. The netlogon service performs DDNS refresh, with a according to this a default refresh frequency of 1 hour. But according to this, it refreshes every 24 hours - it's what I observe in the timestamps of my own SRV records as well.
  4. The default scavenging interval is 7 days. Scavenging removes any dynamic record whose timestamp is older than (todaysdate - scavengeinterval); those records would remain until deleted (either manually or by some other process like a DC demotion) if there were no scavenging. Scavenging does not touch static records (those you created by hand) unless you explicitly allow scavenging for the record.

So, keeping all this in mind, you should be fine with scavenging, as long as you are not scavenging more often than your records can refresh themselves. You can verify that your records really are refreshing themselves by taking a short look through the timestamps in whatever zone you are considering scavenging.

IMHO, scavenging is always a good idea, and yes this includes the _msdcs zone. If a DC stops refreshing its DNS records, scavenging will automatically remove those records and that's a good thing - you wouldn't want people resolving to broken DCs.

I consider the article Don't be afraid of DNS Scavenging. Just be patient. to be the canonical best practice for Windows DNS scavenging.

share|improve this answer
    
Thanks for the info. I was aware of the general function of the zone and this confirmed my suspicion that scavenging most likely didn't break anything. The zone is a bit of a black box to me so I just wanted to make sure. –  MDMarra Sep 12 '11 at 22:06
    
No worries, I wasn't suggesting ignorance. Just trying for a well-rounded answer. –  quux Sep 13 '11 at 0:25
    
I know :) That's why I accepted your answer over Shane's even though he was a little faster. –  MDMarra Sep 13 '11 at 0:38

Scavenge it, I say!

Everything in there is automatically populated by the DCs, as long as they're allowed to - as long as you're not scavenging it ridiculously frequently then there should be no problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.