Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a single domain in multiple forest environment. I tried to add a record to one of the reverse lookup zones of the domains which is a single domain in the single forest , i didnt have the authority to do so , so i tried to see the properties i couldnt see security tab being a domain admin; Later i added my self to the enterprise admin group, even then i couldnt see security tab and couldnt edit the zone.We have a seperate AD team which manages AD and DNS, but my question is how can they lockout the zones to even enterprise and domain admins? How is it possible? This is a simple matter of request being sent to them any way but i want to know the security mechanics involved.

-> Additional things are there are multiple forests which we have trusts with.

-> Even though you can controll domains DNS thorug external groups via trusts , thus they supercede the forests own enterprise admins or the domain's domain admins?

Please do let me know the questions or clarifications if required.

share|improve this question
    
"...Later i added my self to the enterprise admin group, even then i couldnt see security tab and couldnt edit the zone. We have a seperate AD team which manages AD and DNS, but..." There is NO "BUT"! If I were on the separate AD team I would be extremely pissed you tried to circumvent my security controls by escalating your own privileges to Enterprise Admin rather than coming to me and asking a simple question. –  August Feb 6 '13 at 15:44
    
Yes but its our AD , thats why we have domain admin priveleges. This is little bit complex structure, lets say we have multiple departments and 3rd party manages AD domains of all the departments.But each department is independent for itself and self sustaining.We are as accountable as they are.Anyway we opened a service request to them but i just wanted to know the security mechanism involved. –  Darktux Feb 6 '13 at 15:56
    
All I am saying is the permissions are evidently handled by another dept/team, which you are aware of yet you still escalated your own permissions to try and discover the issue. This is a big NoNo based on what you have said about your IT permission structure. Even though "its our AD", you don't have access to add a reverse DNS record. I'm sure there is a reason for that and the other team can answer it for you. Even if you were able to do it in the past and now can't, the proper path should be to consult the other team since they manage the permissions. –  August Feb 6 '13 at 16:09
    
Got the reply; though its AD integreted DNS, since the subnet is shared among different domains the reverse DNS is maintained via different opensource product , so its locked out.We can only change forward zone entries. –  Darktux Feb 7 '13 at 15:40

1 Answer 1

up vote 0 down vote accepted

I Got the reply from the team; though its AD integreted DNS, since the subnet is shared among different domains the reverse DNS is maintained via different opensource product , so its locked out.We can only change forward zone entries.

Can this question be closed by any mods, since there's no need for this anymore?

share|improve this answer
    
That's not how this type of site works. Since this knowledge might be useful in the future, you should accept your own answer by clicking the green check to the left. That will show that this question is answered and keep it from bumping to the top of the front page. –  MDMarra Feb 7 '13 at 15:45
    
It says i can only accept after 19 hrs so will aceept tomm. –  Darktux Feb 7 '13 at 18:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.