How to limit dynamic DNS updates

Question

First off, I'm sorry if this is vague, but I'm not very familiar with DNS or DNS terminology.

What I'm trying to do:

I want to limit what hostnames are allowed to dynamically update DNS. I don't want to end up with a malicious user sending a dynamic DNS update with the same hostname as a domain controller or radius server or something.

Here's why this is a problem:

We run a mixed environment shop and have a lot of devices that aren't tied to AD, so I can't limit DNS updates to secure-only.

Can someone please tell me how to fix this and what it's called? DNS is running on Windows Server 2008 R2 domain controllers.

Answer 1

Windows DNS entries have ACLs. Check and/or set them.

Generally speaking, dynamically updated hostnames/A records allow anyone to update them, but static ones do not, but either way, this behavior is configurable.

When creating a new A record/hostname entry, you have the option to either allow any authenticated user to modify the record or not:

And it sounds like "not" is what you'd prefer. Lucky for you, that's the default.

In fact, the default settings work pretty well, in that they won't allow just anyone to poison the DNS records, or take over a domain controller's A record in the DNS table by simply renaming their machine and performing a dynamic DNS update. So unless your DNS environment is has been explicitly configured in a particularly poor and very specific way, you and your boss don't have anything to worry about.

But don't take my word for it... check the ACLs yourself, and try to hijack a domain controller's (or whatever else's) DNS records with an unauthenticated client.

Answer 2

Resolving Name Conflicts

If during dynamic update registration a client determines that its name is already registered in DNS with an IP address that belongs to another computer, by default the client attempts to replace the registration of the other computer's IP address with the new IP address. This means that for zones that are not configured for secure dynamic update, any user on the network can modify the IP address registration of any client computer. For zones that are configured for secure dynamic update, however, only authorized users are able to modify the resource record.

You can change the default setting so that instead of replacing the IP address, the client backs out of the registration process and logs the error in Event Viewer. To do so, add the DisableReplaceAddressesInConflicts entry with a value of 1 (DWORD) to the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \Tcpip\Parameters

The entry can be 1 or 0, which specify one of the following:

1 . If the name that the client is trying to create already exists, the client does not try to overwrite it.

0 . If the name that the client is trying to create already exists, the client tries to overwrite it. This is the default value.

(Technet)