Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here's a quick summary of the environment I support: we have a domain (domain A) that has about 20 client computers. The domain server for this domain and all the clients sit within the network infrastructure of a larger domain (domain B). All the computers get their network settings via DHCP from domain B's servers. I have no control and am unable to make changes to anything to do with domain B.

The problem I have is that currently in order for my domain's (domain A) clients to be able to resolve the domain server and the shares on it they have their DNS server IP address set to domain A's domain server (via the default GPO). Unfortunately when a laptop (windows and mac) gets taken home, they are still looking for the domain server as their DNS server and obviously can't access the internet correctly outside of our environment. Ideally I need a solution where the machines use domain A's domain server as their DNS when inside the office and use what ever DNS server DHCP gives them when they are outside the office. However, since I have no control over the office DHCP server, I'm not sure how this can be accomplished.

Any help and advice that anyone can offer is highly appreciated.

Thanks, Harry

P.S. The solution I'm trying to find needs to require no involvement from the user.

share|improve this question
    
A simple solution would be to set the primary DNS to your server, and the secondary DNS to a know public host, like google's 8.8.8.8. –  SpacemanSpiff Nov 9 '12 at 4:31
1  
@SpacemanSpiff: Agh! No! Never use public DNS servers on AD clients! You're just asking for huge bootup delays and unreliable group policy application. Eek! –  Evan Anderson Nov 9 '12 at 4:34
    
Did I say perfect? :), and wait a second... what happens when AD clients are orphaned from their domain? Is it the split nature of the primary and secondary that causes issues? –  SpacemanSpiff Nov 9 '12 at 4:39
1  
When the client can't resolve the domain's name during boot it doesn't attempt to contact domain controllers to update group policy, and continues with the policy that has already been applied. If some of its queries are getting fulfilled by a DC, and others by a public DNS server, you can get inconsistent operation. In general, domain member clients should always be using DNS servers that are authoritative for the AD domain when they're expected to operate in an "online" mode. Don't even get me started about AD domains that are subdomains of Internet names that have wildcard records... >sigh< –  Evan Anderson Nov 9 '12 at 4:51
    
Hmmm... It seems like Policy-based Assignment in Windows Server 2012 DHCP would be the perfect solution here. –  joeqwerty Nov 9 '12 at 5:00

1 Answer 1

The Right Answer(tm) is to get the 'Domain B' administrators to create a delegation in their DNS servers for the 'Domain A' zone. Then all your problems are solved. That would be the cleanest and easiest resolution.

If you can't get cooperation from the 'Domain B' administrators but you can get Internet name resolution through the 'Domain B' DNS servers I suppose you could do a dirty trick like the following:

  • Rename 'Domain A' to a sub-domain of an Internet domain that you own ("domaina.foo.com", where "foo.com" is a domain you own).

  • Create a delegation in the global DNS for "domaina.foo.com" to the private IP addresses of the 'Domain A' DNS servers ("domaina.foo.com NS 192.168.100.1", etc).

  • Remove your Group Policy setting that assigns the 'Domain A' DNS servers to clients (allowing them to resolve the 'Domain A' name via Internet DNS servers)

This will allow clients, upon resolving the 'Domain A' name through Internet DNS servers, to get a referral to the on-LAN DNS servers for 'Domain A'.

This is going to create long delays on startup, though, when the clients are taken off-site and booted on other networks, because the client will attempt to resolve "domaina.foo.com" names by sending DNS requests to the (private) IP addresses of the DNS servers it receives from the Internet DNS system. You could clear this up by hosting the DNS for "foo.com" on a DNS server that offers "views" (like bind) that would allow you to selectively make "domaina.foo.com" NS records available only if the requests were coming from the public IP addresses used by the "Domain B" DNS servers.

Ewww-- this is UGLY, but it should work!

share|improve this answer
    
In order for a delegated zone to work the DHCP servers in domain B will need to assign the domain B DNS servers to the domain A clients and the OP needs to remove the GPO settings that are assigning the domain A DNS servers to the domain A clients. –  joeqwerty Nov 9 '12 at 4:53
    
@joeqwerty - Absolutely. I'll state that explicitly. (I find the DN server assignment-related functionality in Group Policy to be naseuating, personally, and I can't imagine actually using it. As such, I kinda forget that it exists, even when the OP mentions it...) –  Evan Anderson Nov 9 '12 at 4:59
1  
I love the idea of suggesting this, though, because I actually do it every summer during a volunteer program I assist with. We put up an AD domain within a college's LAN, and join their existing client computers to our domain. Their clients still pull DHCP from the college's DHCP servers and still use the college's DNS servers, but I stick a delegation in our Internet DNS that resolves to the behind-the-college-firewall IPs of our AD DNS servers. I don't have to contend with mobile clients being moved off-site, though, fortunately. –  Evan Anderson Nov 9 '12 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.