12

Currently we have an Active Directory setup, and say the name is 'example.com'. The DNS entries for example.com has two A records pointing to the two domain controllers. I would like internal users to be able to access our website by using http://example.com/ but, we don't run the site off the domain controllers and I don't want to install IIS or some other service just todo a redirect to www.example.com.

If I understand correctly, I should be able to delete those entries, and add a new A record pointing to the IP of the web server and things will not break, as clients typically use the SRV records to locate domain controllers and whatnot.

Is this correct? I don't want to cause an outage is the reason I'm asking before just changing it. :)

1
  • 1
    Of course if you would be happy to use domain.com the problem goes away (unless you have a server called "www"). Jun 25, 2009 at 16:26

5 Answers 5

19

You're learning why you shouldn't use the same domain name for your Active Directory as you're using for your external Internet presence.

The "A" records for the domain referring to the domain controllers are used for DFS to resolve the name of the domain to a domain controller (primarily for client computers to access the SYSVOL). If you delete those "A" records you're going to see group policy break, amongst other things.

If you can't rename the AD domain, I think you're stuck putting IIS (or some other HTTP server) up on those boxes to redirect client computers to the right host.

This is why I name my AD domains "ad.domain.com". You should have a really, really good reason before you create a DNS zone on a private DNS server that matches a zone that the Internet has authoritative DNS servers for already. You've done that, and added Active Directory into the mix.

3
  • Is this still the case in 2023? Can you not create A records in an AD domain zone that point to a webserver for the same domain?
    – Ian Smith
    Sep 29, 2023 at 15:33
  • Is there MSFT documentation about this?
    – Ian Smith
    Sep 29, 2023 at 15:50
  • Wish I could edit my previous comments but there's a 5 minute rule. I'm pretty sure any A records the OP found in their DNS Zone that point to the domain name with values for their DC are actually useless unless they had a webserver running on them. Microsoft Docs state that they use the zone _msdcs.<forest_name> for finding all DCs and DC related services.
    – Ian Smith
    Sep 29, 2023 at 16:54
3

It is required that those A records point to domain controllers. They are must for DFS (SYSVOL, Netlogon access) and replication. In this case you can live dangerously and use some redirection tool or live with asking users to type www.domain.com. You can relieve their pain someways by making a favorites entry for domain in IE or making that home page for them. So they have to type it seldom.

1
  • Is this still the case in 2023? Can you not create A records in an AD domain zone that point to a webserver for the same domain?
    – Ian Smith
    Sep 29, 2023 at 15:33
0

This is the Active Directory equivalent of putting a gun to your servers and pulling the trigger multiple times.

If the entries were created by AD then do not mess with them. You will regret it.

2
  • 1
    That's a little bit extreme. You can always do a "net stop netlogon" / "net start netlogon" to get those records re-registered. Jun 25, 2009 at 16:12
  • 2
    It's a gratifying visual, though!
    – squillman
    Jun 25, 2009 at 16:22
0

If you want your users to get to you web page then just create a new host name in your DNS Manager (not Active Directory) called www and point it to your external web host. Done. then users just need to type www.yourdomain in their browser.

Bit late for you I recon but might help others.

-1

You may solve your problem by deploying a custom host (/system32/drivers/hosts) file to them as a quick fix, i would not recomment messing with the active directory dns entries.

2
  • 4
    No solution involving "hosts files" should be considered a good idea, IMO. Having said that, if you were to do that you'd break access to the domain SYSVOL from those client computers. Jun 25, 2009 at 16:17
  • Think i should have better read this question. thanks.
    – Maxwell
    Jun 25, 2009 at 16:22

You must log in to answer this question.