1

I have a WS2008 R2 server acting as DC, DHCP and DNS server. DHCP is set to always dinamically update DNS-A and PTR records on behalf of clients, DHCP name protection is enabled and DHCP credentials are set and secured.
Today I noticed that DNS records were not matching DHCP records. Oddly enough, DNS reverse lookup was working as intended, but forward lookup was showing wrong (ie: old) Ip addresses.

When I checked DNS for Forward Lookup Zone, all entries were listed as static. Furthermore, on DNS domain properties, Dynamic Updates were set to "none" (on Forward lookup). So I reset Dynamic Updates to "Secure only" and after a while some dynamic entries started to appear in DNS alongside a lot of static ones. So I guess it will work as intended from now on.
My questions are:

1- Right now all clients computers have static records in DNS. Do I have to manually remove static entries in DNS for clients or will DHCP update DNS with dynamic entries and overrite static entries by itself?

2- How did it happen that all DNS entries were set to static on Forward lookup? I did not set up the server myself and it has been running for as little as three months, so it's entirely possible we've had this issue from the start, but I'm pretty sure no one added static entries manually.
Just want to make sure this is not something I might have triggered unintentionally.

Thanks.

Improve this question

1 Answer 1

Reset to default
1

Records that are manually created are by default static. Also, by default, any authenticated user/computer/process can create DNS records. If you want to confirm who/what created the record, check the Owner tab on the security tab of the DNS record properties in DNS Manager.

Improve this answer
4
  • Owner on all static entries is system account (SYSTEM).
    – howtired
    Commented Sep 17, 2015 at 18:53
  • You may want to try running: DNSCMD.exe /AgeAllRecords. If the “Delete the record when it becomes stale” box was checked at time of the record creating, it will set a TimeStamp on it, which will make it eligible for scavenging. See: blogs.msmvps.com/acefekay/2009/08/20/…
    – Greg Askew
    Commented Sep 17, 2015 at 19:18
  • No record was scavenged. I was finally able to push a script with ipconfig /release + /renew on most clients, and DHCP has been overwriting DNS entries for clients that were previously set as "static" as it was handing out leases. I guess all will be back to normal in a few days. Thanks for the help.
    – howtired
    Commented Sep 18, 2015 at 15:23
  • Records that were previously static that now have a timestamp will not be scavenged right away. blogs.technet.com/b/networking/archive/2008/03/19/…
    – Greg Askew
    Commented Sep 18, 2015 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .