Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've got a branch office with no on-site services at the moment and we'd like to change that. The biggest goal is to setup some file servers but faster log ons and DNS resolutions will be welcome as well.

I'm doing some experiments with some VMs on a separate subnet/VLAN so let's say I've got forest and domain

  1. There is a single site Office with a subnet 192.168.1/24 and a single Primary DNS zone
  2. Added a secondary site TestSite with a subnet 192.168.100/24
  3. Created 192.168.100 reverse lookup zone in DNS
  4. Created a VM Branch-DC01 running Server 2012, with IP address
  5. Added to as member
  6. Installed AD DS as a RDOC in TestSite
  7. The main DNS server for is
  8. Setup DHCP scope for the new server and configured for DHCP to always update DNS
  9. Created Branch-PC01 VM running Windows 8 and added to
  10. Branch-PC01 got IP address of from DHCP, DNS server, entry for the member in the forward lookup zone present but not in the reverse lookup zone (significant?)
  11. On Branch-PC01 executed nslookup - result came back with IP addresses of the main DCs from the Office site (192.168.1 subnet)

Now this in my mind isn't right - shouldn't it return ? Or am I misunderstanding the whole concept but how are the logons supposed to be quicker?

Do I need a separate DNS zone (how would that work without a subdomain which I don't want to create, unless required)?

Any ideas/articles which I can be pointed to would be great, I've read through a bunch of TechNet articles and am non the wiser.



Many thanks to @TheCleaner and @charleswj81 your efforts are appreciated.

I've just tried nltest and the result is the same from the branch DC and client PC:

U:\>nltest / /
           DC: \\
      Address: \\
     Dom Guid: d97516d3-4afb-4f0a-8c3f-04a800cd69fb
     Dom Name:
  Forest Name:
 Dc Site Name: TestSite
Our Site Name: TestSite
The command completed successfully

Update 2

  1. Cleaned DNS entries so any _sites containers with TestSite has only SRV records for Branch-DC01 which after restart of the client didn't help.
  2. nltest on the client:

    `U:>nltest /

           DC: \\
      Address: \\
     Dom Guid: d97516d3-4afb-4f0a-8c3f-04a800cd69fb
     Dom Name:

    Forest Name:

    Dc Site Name: Office

    Our Site Name: TestSite



    The command completed successfully`

share|improve this question
First, check on the branch PC and see which DC actually authenticated you. From a cmd line run: echo %LOGONSERVER%. When you says site, I'm assuming you mean ADS&S and that you have separate sites there for your branch? – TheCleaner Nov 22 '13 at 14:14
@TheCleaner echo %LOGONSERVER% came back with a hostname of one of the main DCs from the main site, yes I do have a separate Site with subnet specified and under TestSite -> Servers I can see the test DC as the only entry – hyp Nov 22 '13 at 14:18
Have you tested it more than once? I ask because with an RODC it uses cached login info, so if this is the only/first time it forwards the auth request to a normal DC. Oh and the other DCs, are they at least 2008? – TheCleaner Nov 22 '13 at 14:27
I've just restart the client PC and logged out / back in, every time the %LOGONSERVER% is one of the main office DCs. Looking at DNS it looks like NS records were generated for all DCs (branch + office) for the branch reverse lookup zone - if that's of any help? Tried deleting all but the branch DC from that zone but they just get generated again... – hyp Nov 22 '13 at 14:42
@TheCleaner forgot to answer about version - the main DCs are 2x Server 2008 R2 + 1x Server 2012 – hyp Nov 22 '13 at 15:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.