I want to uncheck "register this connection's addresses in DNS" on my domain controller (for reasons) to prevent it from doing that. Will that prevent Active Directory entries from being created? Also, eventually we might need to disable dynamic DNS. Would that prevent those entries from being automatically created? I know how to export an entire zone with dnscmd and import a zone. But, what about just creating the Active Directory DNS entries with either the above mentioned check box unchecked and/or DDNS being disabled? Is there a command that will recreate the AD entries if necessary for some reason?

  • 2
    "eventually we might need to disable dynamic DNS" -- Why? How did you reach this conclusion? – jscott Oct 13 '17 at 15:53
  • I want to uncheck "register this connection's addresses in DNS" on my domain controller (for reasons) - I can't think of any good reason to do this. Perhaps you can give us some more details on why you want to do this. – joeqwerty Oct 13 '17 at 16:39

As noted by others in comments, there isn't a really good reason for this that I can think of, so yeah I too would probably ask that you elaborate.

When you say 'AD Entries' are you referring to everything below _msdcs in your zones? THe promotion process generally does that rather than them being created by the DC on the fly, but given past interactions with Microsoft PFE (Premier Field Engineering) they would be re-registered by the DC if deleted; however we certainly wouldn't have had DDNS disabled.

That said, I've been through a process with them on site at work where I intentionally tore an AD apart (they call it AD Rescue) and put it back together again. When things go missing under that directory/segment of your DNS you start getting very unusual errors that you have to be very careful with and I think what you're proposing there centers around the DC's NIC and it's own IPv4/IPv6 record, NOT any of the Active Directory service records and the like.

Given what you've provided I could only say spin up a test domain in an isolated VM test environment and give it a try to see if does what you expect, I'd be more than willing to bet Microsoft may reject support of such a configuration though even if your company carries an Enterprise Agreement.

  • It is outside the scope of this question to get into why I want to do this. Suffice it to say that it will be required by a networking configuration outside of my control and as we're using NAT between domain controllers in the same domain, it will not officially be supported by Microsoft anyway (nor should it be in my opinion). I am trying to plan how to recover if something goes wrong or a new domain controller is added, etc. – Roman Oct 16 '17 at 20:08
  • Fair enough, and correct(ish) they provided limited support if you do it through a NAT, I'm having to face a similar configuration for an app my business is trying to cloud host so I've already confirmed that. To answer your original question then, as I gather it, I do not think this would affect the entries that the directory service creates because those are created by the KCC process and other internal components when sites & services does its thing. However, having not tried it, I would recommend bouncing it off Microsoft if you have an EA or support contract with them. – Kyp Oct 17 '17 at 0:35
  • Also, it might be worth noting that the company I'm with has a full enterprise agreement including support, so it may be because of that they're willing to support us. – Kyp Oct 17 '17 at 0:37

I have a partial answer to my question. Dynamic DNS does appear to be necessary for records to get created, which will happen automatically and possibly any time the netlogon service is restarted. Also, a non-importable copy of the AD DNS entries is stored in c:\Windows\System32\config\netlogon.dns. So, that could be used to see what the entries are and manually create them or create a script to interpret this file and create the entries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.