Issues with DHCP DNS updates - events 20319 & 20322

MISAdmin 381 Reputation points
2021-07-28T16:48:44.833+00:00

I replaced a 2012 DC (with DNS and DHCP) with a 2019 server. I am now noticing errors in the DHCP event logs on the 2019 server. I still have another 2012 server and that one is not getting these errors.

"Forward record registration for IPv4 address [[n.n.n.n]] and FQDN computername.domain failed with error 9005 (DNS operation refused."

and

"PTR record registration for IPv4 address [[n.n.n.n]] and FQDN computername.domain failed with error 9005 (DNS operation refused.

  • Both DCs are in the DNSProxyUpdade group.
  • In DHCP, I am using a DHCP account for updates to the DNS.
  • In DHCP, I enabled Name Protection for all scopes.
  • I ran dnscmd /config /OpenAclOnProxyUpdates 0 on both DCs.

If I look at the DNS records, 99% of them have the ComputerName as the owner under the Security tab. This is the way it was before I replaced the 2012 DC. The other 1% shows the DHCP account I setup... which is the way they all should be.

What could be causing this?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,896 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,023 questions

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sunny Qi 10,906 Reputation points Microsoft Vendor
    2021-07-29T06:42:40.187+00:00

    Hi,

    Welcome to Q&A platform.

    Based on provided information, my understanding is we have configured a new DNS & DHCP server in Windows server 2019 and configured Always dynamically update DNS records in DNS tab of IPv4 properties in DHCP server. Both DNSProxyUpdade group and corresponded credentials have been configured on DNS & DHCP server. The issue now is both A record and PTR record cannot be updated by the new DHCP server in dedicate DNS zone. Please correct me if there is any misunderstanding.

    118952-image.png

    Before we go further, I would like to confirm the following information with you:

    1.

    I still have another 2012 server and that one is not getting these errors.

    What's the relationship among 2012 DC, this another 2012 server and the new DNS & DHCP server 2019?

    2. Was the issue only happened in a specific scope or happened in all scopes on DHCP server?

    Best Regards,
    Sunny

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. MISAdmin 381 Reputation points
    2021-07-29T10:03:15.597+00:00

    Hi Sunny. You are correct in your first paragraph but, because I enabled Name Protection, the setting you show is greyed out. It does that when Name Protection is enabled. For question 1, my other DC is a 2102 server and it is not getting these errors. Only two servers here, one 2019 Server and one 2012 Server. For question 2, these errors happen on all scopes.

    Thank you.

  3. MISAdmin 381 Reputation points
    2021-07-30T14:59:07.967+00:00

    Hi. Yes, I have DHCP failover configured between the two DHCP servers. It's configured as a 50/50 load balance failover.

    I see now that the PTR record is being updated by the dhcp account... and the account is showing up in the ACL of the record... but only if I delete the existing PTR record that has the machine account in it. This doesn't work for the Forward record though.

    EDIT: the PTR record is not consistently updating. Sometimes it is updated (and owned) by the dhcp account, other times by the machine account. Perhaps it depends on what DC is handling it (2012 or the new 2019).

    0 comments
  4. MISAdmin 381 Reputation points
    2021-08-04T12:38:11.293+00:00

    Still having problems with this. Anyone else know what's causing this?

  5. Mela Germier 86 Reputation points
    2023-06-07T04:48:33.78+00:00

    Do any have luck resolving this? We are having this also :(

    0 comments