so we're a University campus, and in DNS Manager, all the students phones, tables, etc, are registering their A records in DNS. We don't want them to. Ideally, we'd just have domain joined devices registering/updating their DNS records.
We've done the following:
- DNS: Right click on domain in fwd lookup zone > Properties > Changed "Dynamic Updates" to "Secure only." (it was previously "Nonsecure and secure")
- DHCP: Right click the respective DHCP Scope > Properties > DNS Tab > UNCHECK "Enable DNS dynamic updates according to the settings below"
- DNS: Delete all records from the student subnets (from every DNS server)
It seemed like it was working for a little while, but then every hour, on the hour, I start to see old records repopulate Windows DNS Manager.
What are we missing? The main push for this was, we had a DNS Squatting issue, where a student's phone's hostname was the same as one of our servers, which prevented end users from accessing that server via the DNS name. Temporary mitigation was to create a CNAME for it, as it appears Dynamic Updates don't update CNAMEs, but we'd ideally like to prevent all non-domain joined devices from registering in DNS.
Thanks in advance.