Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows Server 2003 AD DC running here in our office, and I was wondering if it's possible to group some employees to use a specific DNS forwarder, and some to use a different forwarder? I can't find out how to do this at all, and I've been looking for a month or so.

share|improve this question
Why? DNS resolution is DNS resolution. A different forwarder shouldn't return anything different than any other forwarder. – TheCleaner Aug 16 '12 at 20:01
@Alexander Yes they do. Probably more than the rank and file. You know how one of my previous employers lost/quickly settled out of court in a huge hostile workplace lawsuit? Some VP spent his day downloading pr0n, and his screensaver was set to slideshow of all his photos. Meeting in his office with some women, one of whom was in the legal department, screen saver kicks on, CEO nearly has aneurism. – HopelessN00b Aug 16 '12 at 20:16
The upper staff, would be my parents. – Alexander Aug 16 '12 at 20:19
@Alexander That's the best comment I've ever seen on this site – squillman Aug 16 '12 at 20:42
I would advise the upper staff be monitored/restricted just like everyone else.(parents or not). OpenDNS can protect you against time wasting sites AND bad sites (hacking,malware, etc). You want the latter protection for everyone. (And from a leadership perspective it looks to the employees that you are limiting risk, not simply not trusting them.) – uSlackr Aug 16 '12 at 21:56
  1. DNS clients don't use forwarders, DNS servers use forwarders.

  2. You can configure different DNS servers for the computers for these users by using Group Policy. Note that DNS client settings are a computer setting, not a user setting. DNS servers configured via GPO take precedence over those configured locally and via DHCP.


  1. You'll need to set up and configure a different set of DNS servers for these computers/users.

  2. You'll need to make sure that these DNS servers are configured to forward DNS requests for your AD domain to the appropriate DNS server(s) for the the servers that host the DNS zone for your AD domain. If you don't do this then the computers aren't going to function correctly on the domain. They'll fail to authemticate to a DC, won't be able to resolve names for internal resources, won't sync their time to the domain hierarchy, etc., etc.

  3. I'm not saying that you SHOULD do this, I'm only saying that you COULD do this.

  4. I would review your percieved need for doing this and try to find an alternative solution.


Based on your comments to your question:

This page seems to imply that you can implement granular control of DNS resolution via OpenDNS based on AD computers and groups.

share|improve this answer
I like idea number two, through GPO. Tried it but as a user setting, might try it again as a computer setting. What irritates me is that we use Exchange, and the server is also the DNS server. All the users have Outlook setup with the Exchange server being the Win2003Server hostname (server.pja.local), which gets resolved via itself. If I change the DNS servers on a computer, server.pja.local points nowhere and Exchange does not work. Tried to set server.pja.local in the hosts files, but I forgot how those work. – Alexander Aug 21 '12 at 14:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.