3

I have inherited a complete mess of AD/DNS issues that I am trying to plough through. I have a single Forest that is split into 2 Domains, the Forest Root and the Child Domain. There are 2 DCs in the FR Domain and 6 in the Child (2 in head office and 1 at each of the 4 remote sites.) All DCs are running 2003. My issue is that it seems there was a delegated DNS zone created, which seems OK – the 6 child DCs are listed as Name Servers at the Forest level. However, it seems that an identical DNS Zone was created at Forest level for the Child Domain – but its replication scope is Domain. This is obviously not being updated by the Child’s DNS zone – as the Child's is also set to Domain wide replication. The issue is then compounded by another Zone existing in the Child Domain for the Forest’s Domain, this one however is set to Forest Wide – which doesn’t replicate to the Forest as the Forest already has its own Zone and the Domain partition will take precedence…

I also do not have an _MSDCS Domain zone at the Forest level – although, from my research, it seems that this may not be necessary? Now, the Child.Domain.com zone is fully populated and working properly, so I want to keep that and I don’t see any reason to remove the delegation?

So, my thoughts are to:

  1. Create an _MSDCS.Domain.com Zone (if needed?)
  2. Delete the Child.Domain.com DNS zone from the Forest DC (basically empty)
  3. Delete the Domain.com DNS zone from the Child DC – setup conditional forwarders to reference the 2 FR DCs.

Does anyone have any suggestions re this? Everything is working at the moment, DC Diags all good, but it’s not ideal and if the worst should happen, I wouldn’t know where to start looking! I get the impression that this mess was created to get something working, what I don't know, but there must be an easier way?

My goal here would be to have just two DNS Zones; the FR Zone with a delegation to the Child and then the Child's Zone. At the moment, there are four of which two are redundant.

I hope this makes sense; it's taken me a little while to comprehend what's been done!

Thanks in advance…

Improve this question
2
  • Your proposed solution sounds very reasonable - I would hesitate to wonder what they were thinking a bit longer however. Is there any chance of contacting whoever set this up? Legacy applications perhaps? – Chris S Aug 7 '13 at 13:51
  • Hi Chris, thanks for your reply. I do not believe it's possible to locate the previous team, quite a high turnover of staff before I joined. The only things DNS dependent are Exchange (obviously) and a Domain Trust to a third party (Zone Transfer). I say Exchange, because there were rumours of a meltdown a few years ago, I wonder if they just did this to get it going? Other than that, just standard SQL for the accounts people. James – Zoidberg Aug 7 '13 at 14:07
1

I have had a similar issue where we had one of our child domains set their zone to domain replicated when it was already in the forest replication set. This post was pretty easy to follow to clean it up.. The AD _msdcs stuff will all get recreated if you delete it accidentally. You can force this by restarting the netlogon service on the relevant DCs.

Improve this answer
2
  • Thanks. Did you have any brief outages or anything when you changed your scope? I believe the reason my AD is such as mess is because it came from a W2K Forest, it never had the _MSDCS root DNS zone - which 2k3 needs. I believe the multiple DNS zones allowed AD to work without it. You're correct re the _MSDCS recreate, assuming you set the DCs' Primary DNS server to one of your Root DCs - prefereably the one you're creating the zone on. – Zoidberg Aug 20 '13 at 10:48
  • You will lose any DNS records created in the deleted zone that don't exist in the remaining one. You can use dnscmd to dump both zones and do a diff to see what's missing if you are worried they are far enough out of "sync" but if you're using Windows your clients should update their records on reboot. Just be ready to add non Windows boxes back to DNS if they are missing - Get that dump from dnscmd just in case! – TheFiddlerWins Aug 20 '13 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.