Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the need to add 2 AD servers to our domain but at each of these particular sites would like DNS to be stand alone (not AD integrated). I can't say I have every tried this before as I have always made my AD servers AD Integrated DNS servers as well. I have already built the first server and did NOT select to install DNS during DCPROMO but rather install DNS after. It automatically integrated with DNS. How can I remove the AD Integration piece of AD without screwing anything up? And/or any thoughts on how to build this out? Thanks in advance.

share|improve this question
It is possible to do this, however in my experience far more trouble than its worth. – Brent Pabst Oct 18 '12 at 11:33
Why do you want to do this? Tell us why and perhaps we can offer another solution. Attempting to do it without an actual need to do so makes no sense. – John Gardeniers Oct 18 '12 at 12:30
We have the need for certain records to NOT replicate outside of each of these new locations because of our phone system (need to design stand alone survivability and route all SIP traffic from end points at a remote location through the main gateway at the datacenter. By passing through the remote location first so if the Datacenter connectivity is lost a local copy of DNS is on the remote location phone 'server'. From what we are being told the answer to this in a Linux world is to create what they are calling a "DNS view" at each location. Never hear the term before.) – JBu Oct 18 '12 at 13:09
but also the need for them to be on the domain, have authentication survivability, etc. if they lost their WAN link. This is hard to explain in writing what needs to be done. Hopefully this helps. Thanks for any input. – JBu Oct 18 '12 at 13:09
Please expand your explanation on your scenario. How is the SIP traffic related to your AD DNS zone exactly? – joeqwerty Oct 18 '12 at 13:55

It is not the service itself where you can choose whether to integrate with AD or not - it is the zone. Basically, what you are setting there is the storage location for the zone. An AD-integrated zone is stored within the Active Directory store (more precisely within a separate partition of the LDAP directory which is part of the AD). A non-AD-integrated zone is stored in BIND-style files on the filesystem.

After you've created a zone, you simply can set the type and storage location by editing its properties:

enter image description here

Note that with an AD-integrated zone setups, all your zone copies are writeable, i.e. they are all considered "primary". With a non-integrated setup, only a single zone is writeable, so only this can be updated using DNS dynamic update mechanisms. If the server holding the primary zone copy is offline, updates can no longer be performed to the zone until you designate another server as "primary".

share|improve this answer
If I have already performed a DCPROMO, installed the DNS role and it looks like your screen shot (the same settings/indicating AD integration). What will happen if I were to uncheck the "Store the zone in Active Directory" box on the new AD server? Wouldn't this blow up AD DNS by pulling back the DNS records of the other AD servers as they would think they are no longer AD Integrated? Thanks! – JBu Oct 18 '12 at 11:58
@JBu You would have to convert all but one zone copy your DNS servers are holding to "secondary" and non-AD-integrated - this would copy the zone data out to files and change the SOA records accordingly. After that you should be able to convert the last, "primary" DNS zone to non-ad-integrated. No blowing up is necessary in the course of action. – the-wabbit Oct 18 '12 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.