0

We have 2 hardware interfaces on our Active Directory Domain Controllers. The secondary interface should never be listed in our domain's DNS zone, but it is. This is problematic because most machines on the network do not have access to the secondary subnet that the DCs are on.

For example, our primary subnet is 10.10.10.0, the secondary network is 192.168.0.0. When clients on the primary network query our AD DNS servers for the DC address, they often get 192.168.0.15 as a result. Clients aren't on that subnet, so everything breaks.

I've tried every combination of advanced DNS settings on the secondary interface on both machines and yet, the secondary IP always ends up being published in the domain DNS zone. I've unchecked "register this connection's address in DNS" with no success. I've left that checked and set a different DNS suffix for the connection (for a different, working zone) along with checking the "Use this connection's DNS suffix in DNS registration" box to no avail. Of course, I always delete the incorrect DNS listing before trying these settings.

Any ideas would be appreciated!

  • 1
    Have you removed the secondary interface from the list of adresses the DNS Server binds to? – Mathias R. Jessen Jan 7 '14 at 14:10
  • ^ - that...if it's a DC it is probably running the DNS role. So you'll need to do like @MathiasR.Jessen says. – TheCleaner Jan 7 '14 at 14:12
  • The secondary interface is bound because I have another DNS zone that I want served to the secondary subnet. Is that possible without messing up the primary zone? For example, the primary zone is xyz.org which serves the primary subnet. The second zone is san-xyz.org, for the secondary subnet. Bad idea? – bluesmoke Jan 7 '14 at 14:23
  • I'm using a secondary interface for storage network and iscsi connector. – Richard Salts Apr 11 '14 at 6:37
1

More than one network adapter is not recommended on domain controllers.

Routers should do routing not domain controllers :)

Although there are workarounds I think all of them are only causing more trouble when You forget about them later and want to revert back.

Usefull links:

or just google search for multihomed domain controllers. You will always get same answer: - not recommended / causing troubles / but possible.

0

Try to change the registry key of NIC to disable dynamic update.
How-to: http://technet.microsoft.com/en-us/library/cc959739.aspx
You can find GUID of your adapter in Powershell: Get-NetAdapter|Select Name,*GUID

  • Thanks for the advice, I decided to disable the interface and deal with the secondary subnet elsewhere. – bluesmoke Jan 7 '14 at 17:19
0

The server doesn't need an interface and ip address on every subnet in order to host DNS zones for hosts in those subnets. In fact, there's no direct relation between DNS zones and ip subnets.

The server can host DNS zones for any zone that has hosts on any subnet as long as all of the hosts can reach the DNS server. Can hosts on the 192.168.0.0 subnet reach the 10.10.10.0 subnet? If so, then remove the second NIC from the DC and configure all of your hosts to use the DC's 10.10.10.x ip address for DNS.

  • Good points but I want to keep the two subnets entirely isolated. – bluesmoke Jan 7 '14 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.