Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My situation is as follows:

I have a Windows 2003 Domain Controller which is also my DNS server. I have 10 Windows XP Pro PC's which all login to domain accounts. I am about the forward my DNS requests to OPENDNS so I can regulate web access but I have (2) PC's that I would like to keep unregulated. I manually changed their DNS server IP to (8.8.8.8) which worked but that caused my login to fail (by creating a 3 minute delay before it would let me get to the desktop) when I change the DNS IP back to the IP of the Domain Controller, everything works smoothly.

Question is, how can I continue to login to the domain but have a different DNS path...is this possible ?

share|improve this question

closed as not constructive by Brent Pabst, HopelessN00b, John Gardeniers, Scott Pack, Michael Hampton Nov 27 '12 at 14:04

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
So you want to break active directory logins to gain some internet filtering? –  DanBig Nov 26 '12 at 14:07

3 Answers 3

You can do some trickery with forwarders/stub zones to make this happen, but not in the way that you're looking for. What you really should do is have a local proxy/filter device that can integrate with AD, or have an "unfiltered" VLAN that your local filter ignores.

OpenDNS also has an enterprise filter that integrates with your local AD. I've never used this, but it looks like it can do what you're looking for at a glance.

HOSTS/LMHOSTS hackery is ugly and not scalable and should really be avoided at all costs. It's not a supported configuration and while it might "work", OpenDNS's enterprise offering is less than a dollar a day in your case.

share|improve this answer
    
So I would essentially be taking over the job of content filtering rather than letting OpenDNS do it for me. Not an option right now as that would require hardware and software. I think i'm going to start playing around with the HOSTS file and NetBios and see if I can't give the pair of PC's an external DNS IP but still have them contact the Domain Controller...must be a way, there always is. –  user72593 Nov 26 '12 at 1:24
3  
@user72593 - That's going to be unwieldy, prone to error and untenable in the long run. OpenDNS has a "Business" DNS offering that has AD integration that would probably work for you. –  joeqwerty Nov 26 '12 at 1:47
4  
@user72593 Just because there is a way doesn't mean it's a good or recommended way. This sounds terrible to manage and troubleshoot –  Dan Nov 26 '12 at 10:30
4  
@user72593 that article is valid for systems up to Windows 2000. It's no guarantee that it will work on modern releases. I highly recommend that people don't implement these kind of crazy ideas! –  pauska Nov 26 '12 at 10:35
2  
I think you should re-read the comments and look more closely at who said them. There are three other sysadmins that think its an ugly solution besides me. I think you might be assuming that all of those comments are mine. They are not. I'm sorry if you're unhappy with the quality of the feedback that you're getting, but keep in mind that this is a site for professionals and the ones that have commented on this thread have a history of putting a premium on doing things the right way. If you found a workaround that is acceptable to you, no one is stopping you from answering your own question. –  MDMarra Nov 27 '12 at 4:57

If its the DNS server fault please refer to the following links.

EDNS0 (Extension mechanisms for DNS)

DNS Forwarders Problems in Windows 2008 R2 DNS Services

Also ensure the correct DNS setting on DC as per this link.

If the issue persists post the ipconfig /all and dcdiag /q output of DC.

share|improve this answer

So, maybe this is a bit obvious, but...

Why wouldn't you just configure your domain controller to forward all external DNS requests to OpenDNS? That would get you the benefit of the filtering you want, without breaking Active Directory...

share|improve this answer
    
Driftpeasant, I do want to forward all external DNS requests to OpenDNS but I also want to have (2) PC's which are exempt from the filter. So I would be breaking Active Directory but changing their DNS settings. In any case, I found the solution to be LMHOSTS/NetBios. Thanks for your input. –  user72593 Nov 27 '12 at 2:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.