0

my DNS scavenging is not working as I expected.

I have setup DNS scavenging like this on all of my domain controllers:

No-refresh interval: 4 days

Refresh interval: 4 days

and under properties --> Advanced I have Scavenging period: 7 days

My DHCP server is on one of my domain controllers and the lease duration is set to 8 days.

I turned the scavenging on about 3 weeks ago, so it has been running a couple of times already, but in the event viewer it gives me Event ID: 2502 and says:

The DNS server has completed a scavenging cycle but no nodes were visited.
Possible causes of this condition include: 

1) No zones are configured for scavenging by this server. 
2) A scavenging cycle was performed within the last 30 minutes. 
3) An error occurred during scavenging. 

When I go to Zone Aging/Scavenging properties of the zone that I want to scavenge I can see that it has incremented my "The zone can be scavenged after:" by 4 days. I guess that's my "No-refresh interval" doing that? I hope someone out there can tell me why it's not working! :)

  • TL;DR I used the command "DNSCmd . /ZoneResetScavengeServers <ZoneName> [<Server IPs>]" and since my scavenging had already been running for a while I could use the "Scavenge Stale Resource Records" immediately. – Bungicasse Nov 4 '16 at 13:20
1

"Scavenging is set in three places on a Windows Server:

  1. On the individual resource record to be scavenged.

  2. On a zone to be scavenged.

  3. At one or more servers performing scavenging.

"It must be set in all three places or nothing happens."

https://blogs.technet.microsoft.com/networking/2008/03/19/dont-be-afraid-of-dns-scavenging-just-be-patient/

You need to provide an example of a record that you think should be scavenged but is not.

Also, if scavenging is not enabled, the timestamp is not replicated. Timestamps don't start replicating until after scavenging is enabled for the zone(s).

Here is another good piece of information:

"Although you can set every server hosting the zone to scavenge I recommend just having one [in each domain]. The logic for this is simple: If the one server fails to scavenge the world won’t end. You’ll have one place to look for the culprit and one set of logs to check. If on the other hand you have many servers set to scavenge you have many logs to check if scavenging fails. Worse yet, if things start disappearing unexpectedly you don’t want to go hopping from server to server looking for 2501 events."

DNS record cleanup timing is different for records that are dnsTombstoned:

"Everyday at 2AM (non-configurable) the DNS server scans all DNS integrated zones in AD and determines whether the tombstoned record is ready to be deleted. The default retention time of the tombstoned records is 7 days. This value can be changed by the DsTombStoneinterval value (dnscmd w2k8r2dc01 /config /DsTombstoneInterval value) or by editing the registry under HKLM\CCS\Services\DNS\Parameters Value Name:DsTombstoneInterval Value Type: DWORD). The value is in seconds.

At that point the DNS deletes the record."

https://blogs.technet.microsoft.com/isrpfeplat/2010/09/23/dns-scavenging-internals-or-what-is-the-dnstombstoned-attribute-for-ad-integrated-zones/

  • Thank you for replying, I tried reading a bit more about scavenging and I think I might have missed the command: "DNSCmd /ZoneResetScavengeServers". I have a record dating all the way back to 5/30/2016 and it has "Delete this record when it becomes stale" checked. I just recently took over from the previous IT-guy here, and I've never had this problem before. – Bungicasse Nov 4 '16 at 12:55
  • I just noticed, I can't see the "The zone can be scavenged after:" on my other DC. I have two. From your suggestions I guess I should disable scavenging completely on my second DC? – Bungicasse Nov 4 '16 at 13:07
  • uhm okay. It's working all of sudden... I have no idea what I did but it worked instantly when I pressed "Scavenge Stale Resource Records" on my second DC. I will probably disable scavenging on my first DC and let my second DC do the work. – Bungicasse Nov 4 '16 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.