2

I'm learning about Active Directories.

I understand when a computer wants to join a domain, it needs to change his DNS settings to that of the Domain Controller IP address. Then only it can see the Domain Controller, and join in

I find this rather weird and I can't get my head around this.

Why can't the DC connection work like any other client-server application? I.e. the client specifies the IP address of the server, Click connect, and joins the domain.

My Question

  1. What's the logic behind this?

  2. What happens when one wants to use a different (both primary and secondary) DNS server?

Improve this question
1
  • 4
    Active Directory and its associated services are extremely DNS-dependent. If DNS is not working then probably nothing in your domain is working.
    – Michael Hampton
    Jul 2, 2020 at 1:41

1 Answer 1

Reset to default
6

it needs to change his DNS settings to that of the Domain Controller IP address

This isn't actually correct. You need to have your client (the machine you want to join the domain) be using a DNS server (or servers) that knows all the records for the AD domain; that doesn't have to be a DC. In many environments, its really easy to simply make the Venn diagram of all of your DCs and all of your DNS servers be a single overlapping circle, but there's no requirement.

The requirement is that your client use DNS servers that can serve all the AD domain's records - of which there are a lot.

What happens when one wants to use a different (both primary and secondary) DNS server?

If you have the client using a primary DNS that does have those records, and a secondary DNS that doesn't (for example, a public DNS provider), then AD-related lookups will fail on your client if it ever has cause to not get an answer from the primary. Don't do that.

why doesn't Microsoft provide the option to key in Domain Controller's IP Address?

Because, as Michael Hampton said above, so much in AD (and dependent technologies) depends on DNS records, more than just needing the IP of a single DC. The AD login process itself needs to know about AD sites, which are defined in DNS. DFS uses a lot of DNS records, as does Exchange.

Improve this answer
4
  • 3
    In addition to this fine answer, it is worth adding as the OP seems to view AD as just another application service, that AD isn't an Application you use, it is a service that your account and device join and become part of. This means that you cannot refer to it occasionally (which is the impression I get from 'just type in the IP address' thinking) but rather it is something you integrate with tightly all the time.
    – Rob Moir
    Jul 2, 2020 at 7:32
  • Thank you for the great answer and replies. You mention there is an 'AD-related lookup'. Am I correct to assume that every PC, will assume the AD to be of a specific hostname? probably something like activedirectory.mydomain.local
    – user1034912
    Jul 2, 2020 at 8:45
  • 3
    @user1034912 there’s _ldap._tcp.dc._msdcs.<active directory domain> SRV record which lists the domain controllers in the domain. social.technet.microsoft.com/wiki/contents/articles/… lists them all
    – Greg W
    Jul 2, 2020 at 11:33
  • LDAP, Sites, GC records - and that's all just for AD and the login process itself. Once you start looking at supporting tech like DFS, there's even more. As I said in my answer.
    – mfinni
    Jul 2, 2020 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .