So here's a weird one...

I'm managing a Windows AD environment. For whatever reason, when it was built, DNS was not integrated with AD. A month or so ago I went ahead and integrated DNS with AD and all was well, or so I thought.

Now I'm looking in my main Forward Lookup Zone and I'm seeing that the vast majority, but not all, of our A records are static. Most of these records belong to workstations that are assigned their IP addresses by DHCP (also on a Windows server). As a result, we have many different A records for the same IP addresses.

Some of these records belong to machines that have been offline for years, so I'm guessing that this issue pre-dates the AD integration, but I can't say for certain. At the same time, some of the machines are brand new, so it is apparently ongoing. But I have to admit, I have no idea when it actually started happening... I just never noticed it before.

Does anybody have any idea:
A) How this might have happened
B) How to fix it (I think I saw something about a line command to convert a single record)
C) How to prevent it from continuing

Other points of interest:
-All clients are Windows 7 or Windows XP (embedded)
-Domain controllers are mostly 2012R2, with a couple of 2008R2 stragglers that I haven't decommissioned yet
-Single AD site topology
-Domain and Forest Functional Level is 2008R2
-There are only two admins, myself included, and neither of us are creating these static records

Many thanks in advance!


Static records are never scavenged. If you have old static records you want to be deleted, they need to be manually deleted, or converted to dynamic records so that they CAN be scavenged. Build a TEST domain that mimics your production (without AD integrated DNS) and then convert it the way you did your prod domain. Read about and TEST DNSCMD /AGEALLRECORDS. It can literally age ALL records, or only those that you name. After the static records are converted, they will eventually be scavenged.


This sounds like a stale DNS records without DNS Scavenging enabled... Follow the link at the bottom to learn more about it. Just to confirm you mention static addresses, but you mean that the A record never gets removed, rather than the record being labeled as "static" in the timestamp column of the dns mmc, correct? Also, this assumes you are using dynamically updated DNS in AD. Please look here.

  • Thanks for the reply... as I stated in the second paragraph of my original post, the actual A records have "static" in the Timestamp column... the addresses are dynamic, handed out by DHCP. Sorry if I wasn't clear. DNS is being dynamically updated in AD. – user300551 Jul 21 '15 at 15:35
  • It is worth mentioning that aging and scavenging weren't turned on, which surprised me. I activated those last night. – user300551 Jul 21 '15 at 15:36
  • @user300551: "Turning on" scavenging can result in a catastrophic outage. There are specific steps to follow to re-enable scavenging, I suggest you research. blogs.technet.com/b/networking/archive/2008/03/19/… – Greg Askew Jul 21 '15 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.