Hey guys. I'm working with the following scenario. There are 3 servers in this domain.

  • 1 runs Win2003 and is the current name server and DHCP server, joined to the domain.
  • 1 runs Win2003 and is a secondary DC
  • 1 runs Win2008 and is the primary DC.

The domain currently has about 10 clients that run on DHCP and 30 on static. I want to transfer the DNS role over to the two DCs.

What is the best way to do this to make sure that the DHCP clients register their records with the DCs? I also want the records to update on both DCs so that if one of them goes down, the clients are still able to resolve queries and get on the internet.

  • 2
    PDC and BDC? You are running N4 or Windows 2000+? If 2k or newer, there's no such thing as a primary or secondary DC, there are just DC's. – Mark Henderson Nov 14 '10 at 20:57
  • @Farseeker: Don't you just love that? >smile< Active Directory has only been around for 10+ years... – Evan Anderson Nov 14 '10 at 21:08
  • @Evan - I know you're the one that normally gives the little spiel, but I decided to beat you to it this time ;) – Mark Henderson Nov 14 '10 at 21:36
  • @Farseeker: I'm running windows 2003 and 2008. My apologies. By primary and secondary I was referring to the order of importance of the servers. Primary would be the server that we could not afford to lose. I realize that Microsoft made away with primary and secondary domain controllers a long time ago. I am really glad they did. – Bourne Nov 15 '10 at 3:49

To achieve the fault tolerance you're looking for you want an Active Directory Integrated DNS zone being hosted by both domain controllers. Each DC will be configured to use itself and the other DC as a DNS server.

Microsoft can give you some deeper background on how DHCP and DNS work together for dynamic updates. I'll give you a high-level view here.

To allow domain-joined client computers to register with DNS you'll configure the DNS zones to allow secure dynamic updates. (If you have clients that aren't domain-joined and you want them to perform dynamic updates then you won't be able to use secure updates or you'll have to hack together a solution. I'm going to set this scenario aside as out-of-scope for this answer unless you tell me otherwise.)

Your DHCP scope options should be altered to give the clients both DC IP addresses as DNS servers. Personally, I'd look at migrating those devices with static IP addresses to DHCP reservations such that future changes to DNS server addresses (gateway addresses, etc) don't require manual changes on each host. Even if you can't actually use the DHCP reservations (because the device with the static must actually have a static IP for some reason) you should still use DHCP reservations to track your IP address assignment. It gives you a One True IP Address ListTM and doesn't fall out of date like bogus spreadsheet-based "solutions" do because the operational database is the reference source, too.

If your DHCP server is going to perform proxy name registrations for clients then you'll want to create a user account specifically for the purposes of being used as the security context to register DNS records by the DHCP server. You can see more more detail from Microsoft on this point.

To allow clients to resolve Internet names through the DNS servers running on the DCs either leave the default "root hints" installed or configure the DCs with "Forwarders" to DNS servers at your ISP (or OpenDNS, Google DNS, etc).

As far as the "nuts and bolts" of this go:

  • Install the DNS Server role onto both domain controller computers. Since your current DNS server isn't a domain controller the forward lookup zones for your domain have to be stored in standard primary DNS zones.

  • If you don't care about the records in the DNS right now then simply add the forward lookup zones for "yourdomain.com" and "_msdcs.yourdomain.com" to the DNS servers running on your DC's, set them to use themselves and the other DC as their DNS servers, run an "ipconfig /registerdns" and restart the "Netlogon" service and they will register the necessary records into DNS for themselves. After that, your clients can update their own records and your DNS zone will re-poulate. Be sure to do your reverse lookup zones, too.

  • Assuming you do want to retain the data in your current DNS zones the easiest way to migrate them into Active Directory would be to promote the current DNS server to being a domain controller (so long as you don't have any local user accounts on the machine to worry about), change the zone type to "Active Directory Integrated" on each zone, and to allow Active Directory to replicate. After you've done this you'll see your zones (both forward and reverse) become available on the DNS servers running on the DCs (after replication completes. Either force replication or be patient).

  • Once the zones are replicated into AD you can demote the current DNS server machine back to being a member server.

  • You should mark both DCs as "Global Catalog" servers to allow for redundant access to the global catalog when you're rebooting one of the DCs. This goes hand-in-hand with having DNS redundancy.

If you're prefer not to promote / demote the current DNS server but still want to preserve the data currently in your DNS zones you could get familiar with the DNSCMD tool, which you can use to perform command-line manipulation of DNS zones. You can also hack around with standard primary zones at the level of the zone data files making it possible to copy the contents of your current standard primary zone over to a DNS server running on one of the DCs via file copying. (I'm not sure such hackery is "supported" by Microsoft so you're likely on your own w/ anything like that.)

You should also configure aging and scavenging on your DNS zones. This allows old, out-of-date mappings that might've been dynamically registered to be deleted from the DNS zones automatically.

As an aside: There are no "primary" and "secondary" domain controllers in an Active Directory domain. There 2 forest-wide and 3 domain-wide "flexible single-master roles" that are delegated to individual domain controllers (including one called "Primary Domain Controller Emulator") but no single DC is the "primary" DC. Clients will authenticate to either one (by default) and treat them as equal copies.

| improve this answer | |
  • Thank you Evan. This is very helpful! I do actually care about the DNS records so I think what makes sense the most is your idea about promoting the current DNS server. I can't believe I didn't think of that.Thank you about the tip regarding transfer of the two zones as well. Would you happen to have any resources/cheatsheets that explain in detail what the purpose of each DNS container is? I'm familiar with the main container i.e. for the domain etc but what about ldap, msdcds etc. The reason I ask is in case I ever had to troubleshoot DNS, a DNS container reference would come really handy. – Bourne Nov 15 '10 at 4:06
  • Here's a document that goes into a bit of detail re: the SRV records that you're referring to: technet.microsoft.com/en-us/library/cc759550(WS.10).aspx Basically, Active Directory relies on records with known names (relative to the domain's name) to allow clients (and other DCs) to locate DCs in lieu of the broadcast and NetBIOS-based methods that Windows NT 4.0 domains used. Properly functioning DNS ends up being very important to making Active Directory logons and replication work. – Evan Anderson Nov 15 '10 at 10:59

Install DNS server role on both DC's, 1 at at time and let the 1st complete before starting the 2nd.
Set as AD integrated.
On each DC, in the NIC, tcp/ip properties, set each DC to look to itself for DNS first and the other DNS server second. (Some will say the order should be reversed but the principle is the same, each server should have 2 DNS options.)

Run ipconfig /registerDNS on the DC's.

Configure the DCHP server scope:

  • Enter the 2 DNS server IP's
  • Set DHCP to auto-register (Dynamic DNS) w/ the DNS servers
  • Set the account credentials for DynDNS in the DHCP server
  • Set the normal DHCP scope settings: router, WINS, domain name, etc
  • For redundant DHCP, run DCHP on 2 servers but don't use overlapping IP ranges.

Depending on why the clients are statics, you can also enter the 30 statics as lease reservations w/ the MAC address and change them over to DHCP. Remember to backup the DHCP config if this is configured.

Change the DNS settings on this server to look to the new server. Remove the DNS server role on the current server.

| improve this answer | |
  • This is also very helpful Ed. It's good to see consistent answers. Thank you! – Bourne Nov 15 '10 at 4:08
  • Running 2 DHCP servers on the same network: That's not as simple as it sounds BTW. – Saariko Jul 1 '12 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.