2

I took over this small windows network from another admin who is no longer involved. It's a simple setup, one bare metal server with Windows 2016 as a DC and fileserver, all in one. With less than 10 users, I guess that's ok.

Unfortunately, something seems to be off with the DNS configuration. I noticed that I can't access the server using the hostname but it works fine using the IP address.

nslookup servername (simple or fqdn), run right on the DC or from a client, does not work, the error message is particularly confusing:

> nslookup dc1
Server: dc1.example.com
Address: 192.168.1.8

*** dc1 wasn't found by dc1.example.com: Non-existent domain

So, dc1.example.com confirms that it can't find dc1.example.com.

Funny enough, the reverse lookup, i.e. using the IP address instead of the hostname, seems to work fine, it actually gives back dc1.example.com.

By the way, nslookup using client names works fine in both directions, it's really just the DC I can't query using hostname/fqdn.

I'm no DNS expert but the entries on the server seem fine. There are 2 forward zones, one with the prefix _mscds, and in both forward zones, there is an A record for dc1 with the correct IP address. The reverse lookup zone seems set up alright as well.

Also, dcdiag /test:dns did not complain about anything.

All in all, everything else seems to work fine within the network, the users have no complaints. I'd still prefer to fix this but after having worked at this for several hours, I'm a bit stumped. Hopefully someone here knows how to untie this knot.

1

I'm embarrassed to admit this, but in the end,the whole problem was due to a typo. The name of the DC is not actually dc1, it has a longer designation and the word server is abbreviated within it. I'm used to abbreviating "server" with "srv", my predecessor on the other hand used "svr". Clearly, the correct abbreviation (svr001dc) was thrown at me in multiple places, I just switched the two letters in my mind and incessantly checked for srv instead. That's why the reverse nslookup worked fine.

Sorry about the noise. Note to self: Use copy-paste even when things seem obvious.

0

dc1 typically should would be resolvable from nslookup depending on some regkey values.

dc1.example.com should be resolvable.

First off confirm there is an actual A record for the domain controller in DNS.

After this do a full health check of AD as this CAN be a indicator of a bad domain migration and FSMO roles being orphaned but I doubt this is the case given it's a small network and you say it's DC1 but it's worth a check regardless.

https://www.powershellbros.com/using-powershell-perform-dc-health-checks-dcdiag-repadmin/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.