Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My active directory domain's name is "" instead of "mywebsite.local". I had to do this as a workaround to other issues, and to change it will be a pain. When people inside of my company visit "", it redirects to our DC instead of our website. How can I make it redirect to our website?

share|improve this question
I edited your question title and text to make it a little more clear. – Massimo Feb 14 '12 at 22:56
possible duplicate of Sharing Domain name between domain controller and webserver – ThatGraemeGuy Feb 15 '12 at 13:46
up vote 9 down vote accepted

You can't.

You can define any hostname or subdomain you want in your AD's main DNS zone, but for AD to work properly, the A records for the domain itself must point to your domain controllers.

So, having "" pointing to your web site is fine, but having "" do the same is not.

Addendum: hosting your web site on your DC would of course fix the issue, but I strongly advise you against that; DCs are definitely not meant to host web sites.

share|improve this answer
In case your addendum is in response to my answer - I wasn't suggesting hosting the sites on the DCs, but rather installing IIS and hosting a redirect to, which will work, but is definitely putting a bandaid on a broken arm. :) – MDMarra Feb 14 '12 at 23:05
@MDMarra: not directly related... more oriented to prevent someone from actually doing that :-) – Massimo Feb 14 '12 at 23:27
I cheated a little, and made my domain controller webpage redirect to This worked perfectly Thank you!!! – Reid Feb 16 '12 at 4:40

You really shouldn't use the .local TLD (or any made up TLD) or the address of a public website. You should use a sub-domain of a domain that you already own (i.e.

The best thing to do is rename your Active Directory Domain. You can't do this if you have Exchange 2007 or 2010 installed, but you can certainly reinstall it in the new domain.

If you don't want to do a rename, which is really the best thing to do, you can do some voodoo like install IIS on all of the DCs that redirect to the external site, but that's a bad fix. Really, just do a domain rename and learn from your mistake.

share|improve this answer
I think a little expansion on WHY they shouldn't use a .local or other made up TLD would be useful. – HostBits Feb 14 '12 at 23:06
The short version is: Hard to get 3rd party SSL certificates for internal use. .local and others aren't reserved. At the rate that ICANN is selling TLDs, there's reason to think that your .local domain might be owned by someone else some day, causing a similar problem to this. It causes mDNS (bonjour) problems with OS X clients on the network. And, to top it off, it's just plain wrong! – MDMarra Feb 14 '12 at 23:22
@Massimo I completely agree. Microsoft has (thankfully) done a 180 on their position. With ICANN's buy-your-own-tld hair-brained scheme, it's only a matter of time before someone owns .local and all of these admins end up in tears. – MDMarra Feb 14 '12 at 23:28
@MDMarra though I strongly agree with you (especially on the non-reserved non-public TLD argument), I wouldn't say that it's "Hard to get 3rd party SSL certificates for internal use.". I've had UC certs issued from VeriSign, GoDaddy, Thawte and (mis)TrustWave, all with non-public SAN's, no problem – Mathias R. Jessen Feb 15 '12 at 2:26
@Ian can you cite the relevent RFC? – MDMarra Feb 15 '12 at 18:00

I always name my internal ad domains so I'm

  1. not using .local or a made up TLD.
  2. using a real TLD so I can get appropriate Certs and avoid DNS issues.
share|improve this answer

I'm going to repeat what uSlacker has mentioned above with a bit more detail as what he says will work. The rather pedantic arguments above are valid but I'll let you decide on whether you want a solution today or would prefer to spend several risky days migrating your domain or renaming it.

Its not much of a problem - you should be able to do this in 30 mins or less. It will not affect the operation of AD in the slightest.

  1. Add an entry in your local dns server on your DC for www ( Put the public ip of your public web site.
  2. Install iis on your dc (if you have more than one you will need to do this on each one)
  3. On the default web page (of each dc) modify index.htm so that it redirects to

Anyone in the office who types will directly open the public site.

Anyone who types will open the default web page on the DC and it will redirect to

You could be more sophisticated and create an IIS site with a header of and put the redirect there so as not to modify the default web site. If you already host other web apps on your DCs then this would be cleaner. Your call.

share|improve this answer

I believe you can make this work, but it adds a bit of risk to your setup. You would need to add IIS to your domain controllers. Then redirect the index.asp to If you have multiple DCs, you'd need it on each.

I do not recommend this approach, but instead tell folks is cannot work as we have done. However I realize business needs may mandate a solution.

share|improve this answer
This answer doesn't really add anything of value. Both Massimo and I covered this approach long before you posted this, and your post doesn't contain any new information/suggestions, making it noise. – MDMarra Feb 15 '12 at 13:59
Your answer started with why he shouldn't use .local which, IMO, is off-topic. Massimo's started with "you can't" which is just wrong. Then the answers move on the to reality and finally get around to an answer in the comments. I thought I'd try to directly answer the OP's question. – uSlackr Feb 15 '12 at 14:27
Then you didn't read either of our answers completely, I say that he can install IIS on the DCs and do a redirect and Massimo says something similar. Also, it's a little presumptuous to assume that his start page is index.asp. Massimo's answer is correct. You can't do what the OP wants. You can work around it with IIS redirects or hosting a copy of your site directly on the DCs, but you cannot just tell internal clients of a AD to connect to an external web server when they're using a browser, but still have AD work correctly. – MDMarra Feb 15 '12 at 14:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.