2

I recently upgraded from a 2003 to 2008 r2 domain. My user workstations have been having problems with registering updated DNS names. I traced this down to our old domain controller having the nonsecure dynamic update box checked. When I disabled the DNS services and redirected to my new environment these updates stopped working.

What do I need to do to allow my clients to perform these updates without enabling these nonsecure updates? All the documentation I've seen has pointed to using the nonsecure option but several have stated it is possible to continue using secure updates.

The permissions on the DNS objects are basic - the owner is the SYSTEM account and there are no references anywhere in the security granting the named computers rights over their records.

Improve this question
3
  • The workstations are members of the domain hosting the DNS zone right?
    – Zoredache
    Dec 1, 2011 at 22:28
  • Correct - I wasn't expecting to have to make any change at all for that reason.
    – Tim Brigham
    Dec 1, 2011 at 22:32
  • 1
    Have you tried enabling debug logging technet.microsoft.com/en-us/library/cc776361(WS.10).aspx. What are you seeing? Can you run wireshark on one of your DNS servers and run ip config /registerdns on a couple clients? Do you see the update requests being submitted to the server?
    – Zoredache
    Dec 1, 2011 at 22:43

1 Answer 1

Reset to default
3

It looks like you're seeing the default permissions that are applied to DNS objects when non-secure updates to an Active Directory-integrated zone are performed. Now that you've switched over to requiring secure updates the clients don't have permission to perform the updates.

At this point your options would be to:

  • Add the computer account with "Write All Properties", "Read Permissions", and "All Validated Writes" permission to each DNS record (ideally with a script but you can test by adding the permission "by hand" on a single record and performing an ipconfig /registerdns on the subject client computer).

  • Delete the old DNS records (either "by hand" or by way of "Aging and Scavenging") and allow the clients to register new records securely.

If you're at all able to just delete the old records and let the clients re-register themselves I think you'll find that course the easiest to manage.

Improve this answer
3
  • If possible -- I second the "easiest" method above in deleting the record from the zone and letting the clients re-register themselves with the proper permission. Re-register manually with ipconfig /registerdns or simply reboot the client.
    – Weaver
    Dec 2, 2011 at 1:01
  • That was exactly the problem. Many thanks. I exported a copy of my DNS to text and used a psexec against the a file containing the IP addresses of my deleted systems to reregister the DNS. Not the most elegant but it worked.
    – Tim Brigham
    Dec 2, 2011 at 17:30
  • @timbrigham: It's not about elegant. Results are what count. >smile< Glad I could help you out.
    – Evan Anderson
    Dec 2, 2011 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .