Score:0

How can you de-couple DNS server from the AD Domain Controller?

jo flag

I have an environment where Active Directory Domain Controllers host their own DNS domains (as is common).

However we are trying to separate DNS and host it on a standalone server (to eventually move to Linux Bind, but for now just the decoupling)

I have tested this in a lab environment but can't get the decoupling to work.

Step One - Basic Setup

  • Create an AD zone "mylab.com"
  • Add a domain controller "server1.mylab.com"
  • AD can update the domain perfectly fine

Step Two - Move out DNS zone

  • Backup and delete the entire zone "mylab.com"
  • Create a Conditional Forwarder for "mylab.com" pointing to standalone DNS server
  • Manually create a new zone "mylab.com" on the standalone DNS server
  • Allow Insecure Updates on the standalone server (On Bind it would be 'allow-update ACL')

Step Three - Test DNS Updates from AD to Standalone

  • Restart NetLogon Service

this should trigger the DC to create all the AD related DNS records on "mylab.com" hosted on the new Standalone DNS server.

but I don't see any attempts of DNS updates on the standalone DNS server logs.

I do see DNS queries coming in from the DC, but no updates)

cn flag
If you don't see updates originating from the domain controllers, try ipconfig /registerdns. Also check the event logs, including the Directory Service log.
Score:1
jp flag

I don't see any mention of updating the name server records. The link below describes the process which involves a dns zone transfer.

https://community.spiceworks.com/topic/2266049-migrating-from-windows-dns-to-bind-dns-on-linux

madacoda avatar
jo flag
You're right, those are important steps. I left them out for simplicity only. When I say "move the zone to the new server" I really do mean all those migration steps. Migrate zone data, zone transfer, change NS records, etc.
Score:0
jo flag

The steps are all correct. I got it working with the same steps.

The only issue was the FQDN of the NS records may need to be forwarded separately if they are not part of the same domain. Otherwise the DC won't know where to send the DDNS updates. It does this by first looking up the SOA and NS records of the zone.

In my specific environment, I had to modify the NS records to be in the same zone.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.