3

I have to setup a small windows network inside my bigger linux/mac infrastructure. In order to get the windows clients logging onto the domain, I have had to make the DC their primary DNS server, which seems to have worked.

I would much prefer to have one DNS server running on my network, or at least one authoritative server running on the network.

I have a USG 200 router/firewall and I can configure some static records for DNS, but I an not sure what I need to put in order to get DNS and AD working together, and hints and tips appreciated.

Improve this question

3 Answers 3

Reset to default
14

The first thing you should know is that Active Directory and DNS are so intertwined that they're almost one. For all intents and purposes, you should forget the idea of having an Active Directory domain which doesn't have a primary DNS server for Windows clients.

I won't say it's "impossible", but I will strongly advise you that it's a path with only pain.

As an alternative, why not let AD and DNS do their thing together and then add forwarders to your normal DNS servers. It's the same end result, you can basically forget about your Microsoft DNS server as it will just plod along doing its own thing as you actively maintain and update your other Name Servers.

Improve this answer
10
  • 5
    This is the right answer. Point all Windows clients to the DCs for DNS and then use a global forwarder to forward everything else to your other DNS servers. You are using a third-level unused namespace for your AD domain, as outlined in Microsoft's best practices, right? That way you don't have a split brain DNS.
    – MDMarra
    Jun 25, 2012 at 12:38
  • There is no reason to add forwards and complicate the setup if DNS is already functioning properly. Might as well carry around 4 spare tires for your car.
    – Jim B
    Jun 26, 2012 at 20:09
  • 5
    Totally disagree @JimB , I think an inexperienced Windows Admin trying to get AD working on a non integrated DNS system will only face problems in the long run. I really don't see an issue with letting AD DNS do its own thing for the Windows Clients.
    – Dan
    Jun 27, 2012 at 7:24
  • @dan, having cleaned up about 30 different infrastructures where there were 2 separate dns systems, and one side or the other was poorly maintained, there is simply no advantage, whatsoever in duplicating efforts, especially when you think you can just "forget about it". Proper DNS is vital to functional AD.
    – Jim B
    Jun 27, 2012 at 12:07
  • 1
    @Dan do you normally require multiple dns infrastructures? Most places use 1 DNS system (as per the OP's request) In the places where you have duplicated DNS infrastructures how do you keep the directories in sync? I find it amazing that somehow you think that an inexperienced admin will find it easier maintaining a parallel DNS service (that they likely have no experience with) on top of AD rather than simply using the DNS service they already have (and presumably understand how to run). What are these "pain" points you are worried about using DNS that wasn't made by Microsoft?
    – Jim B
    Jun 28, 2012 at 3:01
1

Just deploy AD on subdomain like windowsdomain.example.com instead of on example.com, and then delegate this subdomain to your domain controllers. This way, you will get two domains, which you could potentially split up for greater security.

Improve this answer
9
  • having separate dns namespaces does not increase security.
    – Jim B
    Jun 25, 2012 at 16:01
  • Like I have facebook.com, google.com and hotmail.com, if you got my password from google.com, you can hack into facebook.com, but not hotmail.com, so y having two email accounts on two domains limits damage when you manage to hack into one of them, e.g. via hotmail via cookie check bug or something.
    – Andrew Smith
    Jun 26, 2012 at 0:50
  • ps. this is active directory, it has it's own independent authentication, policy and so on, so the users list is even different.
    – Andrew Smith
    Jun 26, 2012 at 0:55
  • I mean to isolate this domain with the firewall would make a lot's of sense - so the viruses wont jump around. Windows ISA Firewall is working good.
    – Andrew Smith
    Jun 26, 2012 at 1:02
  • Having separate DNS namespaces has no impact on access. dom.com and dom2.com can be served by the same infrastructure. facebook and hotmaail (should the gods decree) could very simply unify authentication services. Having 2 authentication providers would potentially double administration costs.
    – Jim B
    Jun 26, 2012 at 20:09
0

You do not need to run windows DNS on a domain controller for proper functionality of AD. DNS is the backbone of AD so you want to have a very resilient very reliable DNS infrastructure prior to adding active directory. I would strongly recommend using either windows OR your existing DNS infrastructure but I would not use both. Bind 9 will work fine. You should verify that the namespace you are using is valid for active directory.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .