DNS at Remote Site with RODC

Question

Hi Everyone,

I'm setting up a new remote office, and need some guidance in how I should configure DNS on this system. I'm setting up an RODC on premise, and will be configuring the firewall to set all the local clients to the RODC for DNS. This site is currently part of our MPLS network, but that will soon be replaced and SDWAN with IPSEC tunnels. At our data center we have our main DCs as well as our DNS filtering system (Cisco Umbrella). What is the best method to make sure that clients point to their local RODC for authentication and group policy, but also ensure they get their DNS relayed to the Umbrella system for filtering? How should I program the DNS on the local RODC?

Thank you

Answer 1

Hi @Anonymous ,

DNS setting on RODC. Recommended setting for RODC that’s a DNS server, it should point to itself as the primary DNS server.

For your reference:

RODC Post-Installation Configuration

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

What is the best method to make sure that clients point to their local RODC for authentication and group policy,but also ensure they get their DNS relayed to the Umbrella system for filtering?

On IP settings of each machine in remote site you can set many DNS resolvers but you can set only the IP of RODC as DNS resolver, if you want avoid any communication between local client and other DC.

On RODC you can set the IP of DC main site then its IP as second DNS resolver.

If you want that the local client contact only the RODC for group policy and GPO, you have to create a AD site for this remote office, move only the RODC to this site and assign all client subnets to this site through the wizard( sites and services active directory) .

Please don't forget to mark this reply as answer if it help you to fix your issue

Answer 3

Hi ,

Here is a article talking about some important considerations when placing a RODC at a site, please check if it helps:

Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Plan DNS Servers for Branch Office Environments

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.