But when the acme.com DC's TCP/IP stack points to a DNS server other than itself, a query for the primary DNS server ends up on the public Internet's DNS servers and returns the address of the DNS server for the registered acme.com domain. When Netlogon tries to write records to that UNIX DNS server, the server refuses the updates and Netlogon reports the problem in the System log as event ID 5773: The DNS server for this DC does not support dynamic DNS. Add the DNS records from the file '%SystemRoot%\System32\Config\netlogon.dns' to the DNS server serving the domain referenced in that file.
If you can't convince a workstation to log on to a new AD domain or if Dcpromo refuses to run on a second machine that you intend to be another DC in your domain, check the System log for event ID 5773. If Dcpromo told you that it would configure DNS for you, event ID 5773 is proof that you need to point your DC's TCP/IP stack to itself.
For further proof, start up the Microsoft Management Console (MMC) DNS snap-in, double-click the icon for your server, open the Forward Lookup Zones folder, then double-click the folder for your domain. A folder that contains only two or three records and no other folders indicates that Netlogon couldn't find the DNS server that's running on the same computer as Netlogon. Configure your computer's TCP/IP settings to point to your computer as the preferred DNS server, restart Netlogon, then again check the folder for your domain; it will contain four folders full of find-a-DC information.
Adding a Second DC
But you're still not out of the woods. Your first DC can now find itself, but a second DC won't be able to find the first one. After you put Win2K on a second machine and join that machine to acme.com, you need to configure that machine's TCP/IP stack to look to the first machine as its preferred DNS server. You can do the same for any systems that you want to make into additional DCs.
If you want your network to grow, you can make a few more Win2K servers into DNS servers for acme.com. Because Dcpromo automatically makes the acme.com zone into an AD-integrated zone, you can use only DCs as acme.com DNS servers. If you don't want an AD-integrated zone—perhaps because you want to use non-DCs as DNS servers in the domain—you can convert the AD-integrated zone into a standard primary zone with a few clicks. Simply open the DNS snap-in, double-click the DNS server's icon, then open the Forward Lookup Zones folder. Inside, you'll see a folder labeled with your domain name. Right-click that folder, choose Properties, then click the General tab. Click Change and select Standard primary instead of Active Directory-integrated.
Building It Right
By now, our DNS infrastructure is in pretty good shape. Let's look at how to expand it to larger networks. But instead of letting Dcpromo discover that a problem exists with DNS, let's make sure that DNS works from the start.
Suppose you actually work for acme.com and are going to set up AD for the company. Would that be a simpler scenario? You'd just replace the existing DNS servers with servers that accept dynamic updates, right? Probably not. AD stores information in a DNS zone that you might not be comfortable advertising on the public Internet. So even if you work for acme.com, you'd still want to fake out AD by letting it use an internal-only DNS, thereby causing AD to leave the publicly visible DNS untouched. Such a setup is called split-brain DNS and is a good idea for any enterprise, security-wise. Suppose Acme's ISP hosts the publicly visible acme.com zone. Here's how you'd set up an internal-only DNS for acme.com's AD.
First, set up at least one more DNS server on the acme.com intranet. On the first server that you set up, make the acme.com DNS zone a standard primary zone and enable dynamic updates. On any subsequent servers, set up acme.com as a standard secondary zone. (You can even use NT 4.0 servers as secondary DNS servers in AD, provided that those NT servers run Service Pack 6a—SP6a.) Configure the TCP/IP stacks on each workstation and server in your intranet to use one of your internal DNS servers as the preferred DNS server and another DNS server as the alternative DNS server.
Now, when you run Dcpromo, it will find the acme.com DNS server that you want it to find—your internal DNS server—and will set up AD correctly. Workstations and servers will be able to find that DC to log them on, and when you run Dcpromo on other systems to create additional DCs, Dcpromo will run fine. After you set up AD, you can shift your zone to AD-integrated.
Now that you have two sets of books DNS-wise, you have only one more thing to do. If someone inside Acme tries to find www.acme.com, that user will always find the zones on the intranet server and won't be able to find the public zone. So, be sure to manually copy the records in the public zone to the intranet zones. If you don't, you'll discover that the only people who can't see Acme's Web site are the people inside Acme, which makes for a strange situation.
Register
cengiz February 22, 2004