Ldap mnemonics not applying

Mishaua 716 Reputation points
2022-11-15T06:49:46.3+00:00

I want to capture any direct dependancies to a DC that I want to decommission. I am following these guidelines: https://www.devopsage.com/domain-controller-decommission-step-by-step-process-to-identify-apps-connected-to-a-specific-dc/. I have configured the "DC locator DNS records not registered by the DCs" gpo and one of the mnemonics that I have configured is LDAP. When I query dns for _ldap._tcp.<DnsDomainName> record the server name still comes up in the list. All the other mnemonic records that I included no longer return the server name. I suspect it might be due to a know issue about using upper case in the dc server host name. Is it fine to delete the _ldap._tcp.<DnsDomainName> dns record for the server? Removing that GPO should get it republished?

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,802 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,937 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,023 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gary Reynolds 9,391 Reputation points
    2022-11-15T09:52:29.45+00:00

    Hi

    Have a look at the official Microsoft content for the mnemonic names and yes they are case sensitive - https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/optimize-dc-location-global-catalog

    Is there a specific mnemonic that is not working or it all of them?

    Gary.

    0 comments
  2. Mishaua 716 Reputation points
    2022-11-16T19:36:59.557+00:00

    I think my problems may be due to this https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dns-registers-duplicate-srv-records-for-dc. The dc in question has uppercase letters in its name. I am seeing duplicate entries with an all lowercase entry and an uppercase one. I have some 2012r2 Ad integrated DNS servers and one 2016 AD integrated dns server. It is not a PDC though. The 2016 server has the patch applied but the servers were probably added before then. I tried on a dc that had a lowercase hostname and the gpo applied as expected. Is there a command to force re-registration of the dns records required by a dc? I would like to remove dns entries and have them recreated to see if that produces duplicates.

    0 comments
  3. Mishaua 716 Reputation points
    2023-03-10T21:37:40.93+00:00

    The answer is...

    This was definitely related to the the dc name case issue. First issue is is that the Microsoft article https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/optimize-dc-location-global-catalog is missing some srv records that the mnemonics remove. That means that the best way to verify is to use the C:\Windows\System32\config\netlogon.dns file. Copy it before applying the settings, then after they are applied, verify that the netlogon.dns file has been modified. After that check if the srv records defined in the old netlogon.dns file are actually removed. I made a script verify those entries and also let me know if there are duplicates. https://github.com/Misha305/PoshScripts/blob/main/DCNetlogonDNSChecker.ps1

    In my case I still have a handful of 2012r servers and 2016 server (this one created the duplicates I suspect). I also have a 3rd party ipaddress management system. When I tried to delete the duplicate srv records with a powershell command against the 2012 r2 servers they were immediately there again. When I tried to delete them against the 2016 server they would go away for a couple of minutes, but then be re-added again. DNS server logs showed that the Ipam server was re-adding them again. Interstingly enough, while DNS saw the duplicates the ipam server did not.

    To actually delete the records, I had to delete them from ipam, query the 2016 server until one of the duplicate records had been removed via replication. Once it was removed I removed the remaining via pwershell against the 2016 server and queried all the dns servers in my environment the changes had replicated and the records were all gone. I used another script to query dns to make this a little easier. https://github.com/Misha305/PoshScripts/blob/main/DCPublishedDNSCheck.ps1

    0 comments