Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: we have 150 users using AD on domain ABC. Windows 2003. that serverDC1 has a DNS, DHCP roles, and there is serverDC2 which is its live DNS backup. logs seem healthy.

then we chose to upgrade to new server (Windows 2008) while keeping the old while we transition groups of users to the new domain called ABCNEW.

we installed a DNS role for the new serverNEW.

We gave a 2-way trust relationship to both domains.

this is all on the same LAN (!). we currently point the new DC's DNS to our non primary (DR) 2nd backup Router. primary router T1 data GW is, DR router data GW is, both plugged to the same switch, the DR router is also the data line for the DHCP server. Keeping the T1 data line for servers only.

Issue 1: i'm having Windows 7 clients logging into domain ABCNEW and their user profiles disappearing, internet access is flaky, when i give the client pc's a static ip i get weird connection issues.

Issue 2: On the old domain Administrator accounts no longer have admin rights, even adding Ent Admin to a user doesnt allow the user admin access. not sure this is related but it started happening around the same time.

Issue 3: Some of the new domain servers (web server, file server) cant access the internet, only internal LAN when on STATIC, but when on DHCP - they can go online but CANNOT contact the new DNS server.

Questions: 1.Can two "DC's" in different domains have two separate DNS servers on the same LAN? 2.Can the old DC's DHCP server service the new domain as well? if so is there a special way of setting this up in the new DC's DNS server settings?

share|improve this question
Why make a new domain? You can join the new servers to the old domain, promote one to primary, make sure everything is replicated (including DNS), and then retire the old servers, all while preserving continuity for your users with much less work on your part. – Joel Coel Jan 7 '13 at 16:20
true, but the old domain is exhibiting some behaviour which scares me - 1. some logins lose their permissions, ex a login with edmin permsissions does not have admin rights, group with admin permissions exhibits the same lack of admin abilities despite being in the amdin group. it feels right to move to a new domain. – user152374 Jan 8 '13 at 18:22
I suspect this is because of your update to Windows 7, not the domain issues (Windows 7 is supposed to not give anyone, even admins, administrators rights by default by design), or if it is domain issues, the new servers with a clean replication would resolve them. Also, that seems like important information to include with your question. – Joel Coel Jan 8 '13 at 18:24
What do you mean by "we currently point the new DC's DNS to our non primary (DR) 2nd backup Router"? Standard practice is to only use Active Directory Integrated DNS servers (read: on the domain controller) in an AD domain. – Jonathan J Jan 9 '13 at 20:46

There are a couple of ways that I might configure this.

First way is to add conditional forwarders. In the DNS on the old domain, you'd have a forwarder for the new domain pointing at the new DC/DNS. On the new domain, you'd have a forwarder for the old domain pointing to the old DC/DNS. Your DHCP options would have both the old DC and the new DC as DNS servers.

Second way is to replicate the zones from the new domain to the old DC/DNS as a secondary, and vice-versa. DHCP options would include both servers. This is a little uglier to implement, but does provide a measure of redundancy in the event the sole DNS server for one of the domains is down.

In the interface configuration of Windows computers and servers in an Active Directory domain, it is recommended to only use DNS servers within the Active Directory domain. If you use an external DNS server, such as your ISP or the one provided by your gateway router, you may have lookup failures on the local network because that DNS server does not have the proper entries. Note that Windows may use the secondary server even after the primary server becomes available. Please review for a discussion on server prioritization by the DNS client service.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.