Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I administer the network in my (very small, ~110 students) school. We have a Windows Server 2008 R2 Standard server, and we use Windows 7 Professional. We have ~10 workstations and 5 laptops, the latter of which connect sometimes over Ethernet, and sometimes over Wi-Fi. I've noticed that this creates duplicate DHCP leases, and then only one of those can get registered in DNS -- the second simply fails. Is there any way to fix this, so that when I, for example, ping laptop-1, it'll get to the laptop no matter which interface is currently in use?

share|improve this question
1  
Something isn't working right. Both connections should be registering in DNS, unless you've got that setting disabled on the Wireless NIC. –  joeqwerty Nov 21 '12 at 14:02
    
@joeqwerty Hmm, just turned on the wifi on one of the workstations and connected, and it seems to be working. However, I've been seeing these messages in Event Viewer on the server: "The DNS registration for DHCPv4 Client IP address 10.0.0.## , FQDN host.domain.local and DHCID <48-character base64> has been denied as there is probably an existing client with same FQDN already registered with DNS." What does this mean? Also, even if both DNS records do show up, won't there still be the problem that the laptops are only using one or the other at any given time? How is that handled? –  Micha Nov 22 '12 at 10:46
4  
@Micha - Windows clients will register their own DNS records, but the DHCP service may also attempt to register a DNS records on behalf of the clients. Whoever registers the record first becomes the owner of that record and only the owner can update it. For example, if the client registers it's DNS record first, the DHCP service may encounter something like the error you've described. Windows clients will register their last DHCP lease with DNS. If a cable (or if wireless radio is turned off), the client should re-register the next time a connection receives a lease. –  Matthew Johnson Nov 26 '12 at 22:42
1  
@Micha - Clients should register their DHCP leased IP addresses with DNS at startup, when the lease changes, or when the lease is renewed. If memory serves, every time a network connection is reconnected after being disconnected, it should query DHCP whereupon it will be assigned the same IP address (assuming the lease hasn't expired). What I can't remember is if this fires off a DNS update like a renewal would. I'm in the processing of building a test lab. When I get a second, I'll test the default behavior and get back to you. –  Matthew Johnson Nov 28 '12 at 21:06
1  
@Lizz (and Micha) - Sorry. I got distracted and then forgot all about my promised research. Based on my tests, a connection will indeed re-register its IP address with DNS every time it’s connected. I'll try to provide a more thorough response in answer to your post... –  Matthew Johnson Jan 7 '13 at 5:15

1 Answer 1

up vote 6 down vote accepted

This post reiterates some of what we've already discussed in the comments under your original post for the benefit of others, but goes further to (hopefully) address your issue.

A DHCP server leases IP addresses to clients based on the clients reported MAC address. So, if a computer has two network interfaces, LAN & WLAN (Wireless LAN), each with its own MAC address, you can end up with two DHCP leases. Both leases will report the same computer name, but if you examine the MAC address (or Unique ID), you’ll note they are actually different records.

In short, the answer to your question is yes – a laptop’s hostname can be associated with both of its interfaces? However, there are a few caveats.

Once the client receives a leased IP address from DHCP, one of several things can happen in regard to DNS registration:

  • The Windows client will attempt to register its IP address with DNS using the DNS suffix supplied by the DHCP server.
  • Depending on how it’s configured, the DHCP server might attempt to register the leased IP address with the local DNS service on behalf of the client.
  • The client and DHCP server might both try to register the leased IP address with the local DNS server.

If the DNS server is configured to allow only secure dynamic updates, the first system to update the record becomes the owner and all other attempts to access the DNS record will result in access violations. For example, if the client registers its DNS record first, the DHCP service might encounter something like the errors Micha has described.

When the DHCP service registers a connection on behalf of a client, it will register the most recently leased or renewed IP address using the name supplied by the client. Consider the following:

  1. If the WLAN receives an IP lease from DHCP, the DHCP service will register that IP & the computers FQDN with DNS, overwriting any previously registered entry.
  2. If the LAN is later connected in addition to the WLAN, receiving another lease from DHCP, the DHCP service will overwrite the previously registered IP address (the one that belongs to the WLAN) with the new LAN IP address – note that only one entry exists in DNS, even though both network interfaces are connected.
  3. If the LAN interface is subsequently disconnected, no DNS update will be made since DHCP doesn’t know (or care) that the LAN has been disconnected. Since the LAN’s IP address was the last to be registered with DNS, queries to DNS will not return a valid result.

Unless you have some compelling reason why the DHCP server should be registering IP addresses on behalf of its clients, you should leave DNS registrations to the individual clients. Unlike the DHCP server, the client will register multiple DNS entries – one for each network adapter with an IP address. Consider the following:

  1. If the WLAN receives an IP lease from DHCP, the client will register that IP with DNS.
  2. If the LAN is later connected in addition to the WLAN, receiving its own lease from DHCP, the client will register a second DNS entry. DNS queries for the client’s FQDN will now return two results, one for each registered IP address.
  3. If the LAN interface is subsequently disconnected, no DNS update is made and two DNS entries will continue to exist, one of them now invalid. By default, Windows clients only update DNS when a DHCP lease is granted or renewed (DNS registrations for static IP addresses are refreshed every 24 hours). Fortunately, you can change the default refresh rate using group policy. Once refreshed, the invalid DNS record will be removed. Unfortunately, 30 minutes is the smallest refresh interval Windows will allow.

To summarize, this is what you want:

  • DNS configured to allow only secure dynamic updates (for security)
  • DHCP configured to only register DNS addresses on behalf of clients that request it, or clients incapable of registering their own IP addresses
  • Computers configured to refresh their DNS records every 30 minutes

How to configure DNS for secure dynamic updates:

  1. Open the DNS management console
  2. Find the lookup zone (yourdomain.local or similar) you want to configure, right click it, select properties
  3. Under the general tab, look for the dynamic updates section and select “Secure only”
  4. Apply your settings

How to configure DHCP to NOT update DNS for all clients:

  1. Open the DHCP management console
  2. Find the IPv4 node, right click it, select properties
  3. Under the DNS tab, select the following options:
    1. Select, “Enable DNS dynamic updates according to the settings below:”
    2. Select, “Dynamically update DNS A and PTR records only if requested by the DHCP clients”
    3. Optionally select, “Discard A and PTR records when lease is deleted”
    4. Optionally select, “Dynamically update DNS A and PTR records for DHCP clients that do not request updates”
  4. Apply your settings

Configure windows to refresh dynamic DNS registrations at fixed intervals:

Apply the following group policy setting to all of your computers (or just the laptops):

  1. Edit an appropriate group policy object
  2. Expand Computer Configuration, Policies, Administrative Templates, Network, DNS Client
  3. Find the “Registration refresh interval” setting and double click it
  4. Configure the refresh interval for 1800 seconds (30 minutes)
  5. Apply your settings and wait for the group policy changes to propagate

Note: If you need a shorter refresh interval you could try creating a scheduled task using group policy to run “ipconfig /registerdns”. The command requires elevated privileges, so this option might introduce unwanted security risks.

Hope this helps!

share|improve this answer
    
BTW, I forgot to mention a couple things, and there was one thing that might not be clear. The DHCP errors were from non-domain devices (personal computers, phones, etc.), primarily with the hostnames iPhone/iPad. And what I was seeing happen was that I was ending up with a pair of DNS records. When I get in tomorrow (if I'm not snowed in) I'll give that a try. Thank you! –  Micha Jan 8 '13 at 16:09
    
@Micha - Without knowing the text of the DHCP error your getting, I can only guess that you need to specify a domain user with privileges to create secure DNS records on behalf of non-Windows clients. Create a domain account with minimum privileges (domain users is fine) and specify that user under the DHCP management console's IPv4 node properties, advanced tab, "DNS dynamic update registration credentials". If this solves your DHCP error I'll add it to my answer. Let me know! –  Matthew Johnson Jan 9 '13 at 5:02
    
I think I know what the problem is -- I've looked over the errors again and noticed that they're saying the same thing -- something along the lines of "the DNS registration for [iPhone|iPad].domain.local with DHCID AAAAA..... failed because there is already a client with the same FQDN", which leads me to believe that there are two different people who haven't changed the default names on their iDevices. Thanks for all your help! (I couldn't get in today because of inclement weather, but I'll let you know how those solutions work out as soon as I'm back in) –  Micha Jan 9 '13 at 10:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.