-5

My situation is as follows:

I have a Windows 2003 Domain Controller which is also my DNS server. I have 10 Windows XP Pro PC's which all login to domain accounts. I am about the forward my DNS requests to OPENDNS so I can regulate web access but I have (2) PC's that I would like to keep unregulated. I manually changed their DNS server IP to (8.8.8.8) which worked but that caused my login to fail (by creating a 3 minute delay before it would let me get to the desktop) when I change the DNS IP back to the IP of the Domain Controller, everything works smoothly.

Question is, how can I continue to login to the domain but have a different DNS path...is this possible ?

Improve this question
1
  • 1
    So you want to break active directory logins to gain some internet filtering?
    – DanBig
    Nov 26, 2012 at 14:07

3 Answers 3

Reset to default
6

You can do some trickery with forwarders/stub zones to make this happen, but not in the way that you're looking for. What you really should do is have a local proxy/filter device that can integrate with AD, or have an "unfiltered" VLAN that your local filter ignores.

OpenDNS also has an enterprise filter that integrates with your local AD. I've never used this, but it looks like it can do what you're looking for at a glance.

HOSTS/LMHOSTS hackery is ugly and not scalable and should really be avoided at all costs. It's not a supported configuration and while it might "work", OpenDNS's enterprise offering is less than a dollar a day in your case.

Improve this answer
13
  • So I would essentially be taking over the job of content filtering rather than letting OpenDNS do it for me. Not an option right now as that would require hardware and software. I think i'm going to start playing around with the HOSTS file and NetBios and see if I can't give the pair of PC's an external DNS IP but still have them contact the Domain Controller...must be a way, there always is.
    – user72593
    Nov 26, 2012 at 1:24
  • 3
    @user72593 - That's going to be unwieldy, prone to error and untenable in the long run. OpenDNS has a "Business" DNS offering that has AD integration that would probably work for you.
    – joeqwerty
    Nov 26, 2012 at 1:47
  • 4
    @user72593 Just because there is a way doesn't mean it's a good or recommended way. This sounds terrible to manage and troubleshoot
    – Dan
    Nov 26, 2012 at 10:30
  • 4
    @user72593 that article is valid for systems up to Windows 2000. It's no guarantee that it will work on modern releases. I highly recommend that people don't implement these kind of crazy ideas!
    – pauska
    Nov 26, 2012 at 10:35
  • 2
    I think you should re-read the comments and look more closely at who said them. There are three other sysadmins that think its an ugly solution besides me. I think you might be assuming that all of those comments are mine. They are not. I'm sorry if you're unhappy with the quality of the feedback that you're getting, but keep in mind that this is a site for professionals and the ones that have commented on this thread have a history of putting a premium on doing things the right way. If you found a workaround that is acceptable to you, no one is stopping you from answering your own question.
    – MDMarra
    Nov 27, 2012 at 4:57
0

If its the DNS server fault please refer to the following links.

EDNS0 (Extension mechanisms for DNS)

DNS Forwarders Problems in Windows 2008 R2 DNS Services

Also ensure the correct DNS setting on DC as per this link.

If the issue persists post the ipconfig /all and dcdiag /q output of DC.

Improve this answer
0

So, maybe this is a bit obvious, but...

Why wouldn't you just configure your domain controller to forward all external DNS requests to OpenDNS? That would get you the benefit of the filtering you want, without breaking Active Directory...

Improve this answer
1
  • Driftpeasant, I do want to forward all external DNS requests to OpenDNS but I also want to have (2) PC's which are exempt from the filter. So I would be breaking Active Directory but changing their DNS settings. In any case, I found the solution to be LMHOSTS/NetBios. Thanks for your input.
    – user72593
    Nov 27, 2012 at 2:49

Not the answer you're looking for? Browse other questions tagged .