0

I have configured a TFS server so that the IIS site binding is for tfs.oursite.com. Unfortunately, for now anyone who wants to access it would need to add tfs.oursite.com to their hosts file. How would I go about updating Active Directory so that anyone on the domain can get to the server by going to tfs.oursite.com?

EDIT: Not sure if this will work as I hoped. The reason I set it up to use tfs.oursite.com is because I already had a certificate for *.oursite.com that was handy to use for SSL. But the actual domain the TFS server is located on is named differently and ends in .net.

It seems that the source and target have to actually be on the domain of the server. Am I understanding correctly and does this mean I can't do it this way, and if not is there an alternative solution?

Basically I just want the same behavior of a hosts file, but to be applied to the entire domain instead of just a local computer. Is this possible?

1

Add a CNAME/Alias pointing at the server's actual A record in your DNS:

In Windows DNS management, right-click within the oursite.com Forward Lookup Zone and click New Alias (CNAME). Enter "tfs" in the Alias Name field, and the actual FQDN of the TFS server in the FQDN field. Usually you don't want to tick the checkbox for "Allow any authenticated user to update DNS records..."

  • Not sure this is going to work. Please see my edit and let me know if you have any further suggestions. – BVernon Jan 30 at 10:44
  • You can use CNAMEs even between different domains; it's perfectly fine to have tfs.oursite.com be an alias for someserver.yourdomain.net. – Massimo Jan 30 at 10:47
  • @BVernon: TLS compares the host name in the request with the name in the server's certificate. In other words the server web.foo.net can host a site for bar.com as long as it presents the proper TLS certificate, and as long as there's a DNS entry (A record or CNAME) pointing the name bar.com at web.foo.net (CNAME) or at the server's IP address (A record). – Mikael H Jan 30 at 11:02
  • See my last comment on other answer. I'm clearly not doing it right. – BVernon Jan 30 at 11:06
  • @BVernon This won’t work. You’ve stated your internal domain is .net and you want users to use .com. So you don’t have a zone for .com it sounds like in AD and therefore you can’t add a CNAME for a server using .com. The simplest thing to do is to create an A record on the DNS server hosting the oursite.com domain. It’s ok to use an internal IP address for that A record if you want the server only reachable internally. Alternatively you can add the .com zone to your AD DNS server but this causes split-dns and is far more work to maintain. – Appleoddity Jan 30 at 23:53
1

It would of been helpful to know the version of server, but generally:

  • open Server Manager
  • navigate to DNS Server
  • navigate to Forward Look-up zone
  • open your zone (like oursite.com)
  • in the right area right-click and on the menu select New Alias (CNAME)
  • write the new name that you like to be used as Alias (example: ourserver)
  • write the correct DNS name of your device (tfs.oursite.com)
  • press OK and it's all done

To test if it works, ping the new Alias and the IP from the orginal NS entry should respond (of course if ICMP is correctly enabled and functioning).

  • My bad... 2016. – BVernon Jan 30 at 10:26
  • Not sure this is going to work. Please see my edit and let me know if you have any further suggestions. – BVernon Jan 30 at 10:44
  • 1
    You can use CNAMEs even between different domains; it's perfectly fine to have tfs.oursite.com be an alias for someserver.yourdomain.net. – Massimo Jan 30 at 10:47
  • @Massimo Ok, so I enter "tfs.oursite.com" and the FQDN (which I can't edit) becomes "tfs.oursite.com.oursite.net". Now when I navigate to "tfs.oursite.com" it does not work. It only works if I navigate to the full FQDN which defeats the purpose. What am I missing? – BVernon Jan 30 at 11:02
  • @Massimo Which, of course, it doesn't even work if I navigate to the FQDN. I can ping it, but that's not what the IIS binding is set to. – BVernon Jan 30 at 11:05
1

Because your internal AD domain is oursite.net and the domain name you want to use is tfs.ourdomain.com you will not be able to create a CNAME record in your AD dns server as suggested in previous answers.

The simplest thing to do is to add an A record for tfs.ourdomain.com with the DNS server that is hosting your ourdomain.com domain, which is probably a 3rd party. It is OK to use a private IP address for that A record if TFS is only accessible internally. There is a very small risk of exposing your internal network IP scheme to an attacker, but the information is virtually useless without other attack vectors being exploited. This method is necessary if you intend to have TFS accessible externally.

Alternatively, you can add the zone tfs.ourdomain.com to your AD DNS server. This method is useful for an “internal use only” site and eliminates the risk identified in the previous suggestion.

  1. Open DNS management
  2. Add a new active directory integrated / primary zone. Use the zone name tfs.ourdomain.com
  3. Add a new A record to the zone and leave the name field blank, and specify the static IP of the TFS server.
1

I see all of the other answers here suggest that you add a A record or a CNAME record to the DNS zone database. In my experience, however, I suggest doing something slightly different.

Instead of just creating a DNS record, there is another way. As it's not a domain controller, it will not have this command by default as it is include with the AD DS role. However, you can install the Remote Server Administration Tools for AD and this command should be included with the installation. After that installation, you can use the following command inside a regular cmd prompt (no need for PowerShell) to not change, but rather add a computer name to the system.

"netdom computername (current FQDN of system) /add (alternate FQDN)"

Note that the above command also works if you are changing the name of the system. In that case, you can perform this command immediately after you perform the previous one:

"netdom computername (current FQDN of system) /makeprimary (alternate FQDN)"

From there, you will need to restart the server for the name change to take effect and for the server to register its changes with DNS.

I suggest this method for two reasons. Firstly, though it may not be the simplest solution, it does ensure that as much as possible will continue to work with the new name. Sometimes, SMB, for example, doesn't play well with CNAME or additional A records. Additionally, even so, a new computer name will register with DNS alongside the regular name of the system and will be dynamically updated with the correct IP address, unlike a manually created A record (though a CNAME record will update correctly).

Additionally, there's another reason - if LLMNR (link-local multicast name resolution) hasn't been disabled on the network and your applications use it to contact the server, using this method will ensure that LLMNR will continue to work with both names because the system will be configured to listen for both names.

EDIT - I read the question wrong. I just realized that the server in question isn't a domain controller and as such doesn't have the 'netdom' command by default as a result of the AD DS role. CNAME and A will work perfectly fine, but in my experience, adding the alternate name to the server has always been better.

EDIT 2 - For this to work, you're going to need to build a new zone, preferably AD-integrated

  • 1
    Thanks for the ideas. I think I understood about a third of it, lol. I'll have to do a little research before I can understand the rest but that's ok :) – BVernon Jan 31 at 21:26
  • What don't you understand? I can try and explain it to you. :) – kelvintechie Feb 3 at 21:25
  • Actually I think I get the gist of it after a second read. I got busy with some other stuff, but will be getting back to this sometime this week so I may try this out then. Thanks! – BVernon Feb 5 at 18:46
  • Yeah, so ex: “netdom computername currentname.domain.tld /add newname.domain2.tld”. I haven’t tried this command with having two different DNS suffixes for the alternate names, but I suspect that it will work. Don’t do the makeprimary command in this case though, you’re just adding a second name. – kelvintechie Feb 5 at 21:06

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.