up vote 3 down vote favorite
1
share [g+] share [fb]

I'm trying to figure out what exactly happens when a machine is added to a domain. Once you type in the domain name: 1) What protocol does the machine use in order to figure out which domain controller to use? 2) How is the domain name looked up? Example: domain is setup as dc=company,dc=com, but the "Windows" domain is COMPA. Some how these names are mapped to each other.

I know that Active Directory and DNS are tightly integrated, but I don't quite understand the details. What is the best source of information on the technical details. Most of what I can find tells you HOW to get things done, but not what happens under the covers.

link|improve this question
feedback

3 Answers

up vote 6 down vote

There is a lot of DNS involved.

Here is the workflow when a workstation is given a NetBIOS name to join (COMPA in your example)

  1. Checks its resolver cache to see if COMPA is already resolved.
  2. Does a DNS lookup for "COMPA" without any domain to see if the DNS Server finds it.
  3. Does a DNS lookup for "COMPA" with the various domains in the DNS Search list.
  4. (if you have it) Does a WINS lookup to see if COMPA exists as a Workgroup or Domain.
  5. Checks the Network Browse List to see if a COMPA domain is visible.

Once it finds a domain controller, it them asks it for it's AD DNS name. Then,

  1. Checks DNS for the SRV records for company.com's domain controllers

Contrast this with the workflow for the DNS style of name (company.com in your example)

  1. Checks DNS for the SRV records for company.com's domain controllers
  2. Queries DNS for the SRV records relating to the Domain's AD Sites

A lot shorter. Once it has identified the domain controllers in the domain, it then uses the credentials supplied by the domaining user to attempt to contact the DC. That can happen over any of the x security protocols AD uses:

  • LanMan (LM)
  • NTLM
  • NTLMv2
  • Kerberos

The exact protocol is negotiated between the workstation and the domain controller. If no common protocol can be agreed to, the workstation can't be domained.

link|improve this answer
So an abbreviated domain name such as "COMPA" won't work without WINS being enabled? – Benjamin Peikes Nov 2 '11 at 17:20
Additionally, what happens if the domain is set up with a DNS name that exists in the outside world, but that isn't registered to you? We migrated to a new domain and our admins used abc.com, (that's an example, not what they actually used), but we don't own the abc.com domain. Could this cause issues? I'm not sure why they didn't use ourcompaniesregistereddomainname.com, other than they thought abc.com would be easier to type in. – Benjamin Peikes Nov 2 '11 at 17:23
@BenjaminPeikes An abbreviated domain relies on NetBIOS name enumeration, which works best with WINS but is not required. As for DNS domain, if the DNS servers your clients are using have that name set up as authoritative for forward looking (and they should!) it should work just fine. The public internet DNS domain will not be fully reachable from your network, though., – sysadmin1138♦ Nov 2 '11 at 17:29
Yeah. So it's probably a bad idea to use a domain name internally that you don't own, correct? Example, using abc.com as the DNS domain would seem to be a bad idea. What do you think @sysadmin1138? – Benjamin Peikes Dec 2 '11 at 21:54
@BenjaminPeikes Yes, it is most definitely a bad idea to use an FQDN you don't actually own. The real domain will be inaccessible to anything using your AD DNS servers. A lot of companies get around that by using a fake TLD, but there are good and bad things about that as well. – sysadmin1138♦ Dec 2 '11 at 22:00
show 1 more comment
feedback
up vote 4 down vote

1) What protocol does the machine use in order to figure out which domain controller to use?

DNS. Specifically DNS SRV records.

2) How is the domain name looked up?

You provide the domain name in the domain join process, and windows knows what SRV record queries it needs to issue to get the name/IP of the DC.

After the DC is located, there will be a flurry of other traffic. Some CIFS, some Kerberos, and probably a few others needed to establish the trust relationship, transfer group policy objects, etc. You would likely find it very interesting to fire up Wireshark and do a packet capture of the domain join process. Due to encryption, you won't be able to see the actual packet payloads, but you will be able to see port numbers and relative data volumes.

link|improve this answer
feedback
up vote 3 down vote

The domain locator process is essentially the same whether a client computer is joining the domain or logging on to the domain, detailed here:

http://support.microsoft.com/kb/247811

And this article details how DNS supports AD:

http://technet.microsoft.com/en-us/library/cc759550(WS.10).aspx

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.