How to config the DNS suffix for windows server in terraform deployment steps

Question

To change or remove the primary DNS suffix, we can follow these steps¹:

- Right-click on Start and select System.

- Click on Advanced system settings.

- Click on Computer Name tab.

- Click on Change button.

- Click on More button.

- In the Primary DNS suffix of this computer box, type the new suffix or leave it blank to remove it.

- Click on OK three times and restart your computer.

this is a manually operation in windows server , my question is how to integrate this steps into terraform code when doing the vm depolyment , including the AADLoginForWindows extension ?

Answer 1

do we have the exact code ?

Answer 2

Terraform cannot directly edit the Windows “Primary DNS suffix of this computer” UI, but the same setting is controlled by the Windows DNS client’s primary DNS suffix. That suffix can be configured in an automated way and applied at deployment time.

From the Windows side, the primary DNS suffix is what forms the computer’s FQDN and is used for DNS registration and resolution. It can be set either:

1. As the machine’s primary DNS suffix (System Properties → Computer Name → More…), or
2. Via policy/registry using the DNS_PrimaryDnsSuffix setting, which explicitly defines the primary DNS suffix used by the DNS client.

In an automated deployment (for example, via Terraform):

1. Deploy the Windows VM and the AADLoginForWindows extension as usual.
2. Use a provisioning mechanism that Terraform supports (custom script extension, cloud-init equivalent, or configuration management) to set the primary DNS suffix inside the guest OS by:
   • Applying the DNS_PrimaryDnsSuffix policy (ADMX_DnsClient/DNS_PrimaryDnsSuffix) with the desired suffix (for example, microsoft.com), or
   • Writing the corresponding registry keys and then restarting Windows so the DNS client picks up the new suffix.

The DNS_PrimaryDnsSuffix policy explicitly:

• Specifies the primary DNS suffix used by the DNS client in DNS name registration and resolution.
• Overrides the value configured in the “DNS Suffix and NetBIOS Computer Name” dialog.
• Requires a Windows restart for changes to apply.

In Terraform terms, the flow is:

1. Define the Windows VM resource.
2. Attach the AADLoginForWindows extension.
3. Attach a custom script extension that:
   • Configures the DNS_PrimaryDnsSuffix policy/registry with the desired suffix.
   • Triggers a reboot so the DNS client uses the new suffix.

Once applied, the VM’s DNS client will use that primary DNS suffix for:

• Forming the full computer name (FQDN).
• Registering A/PTR records (if dynamic DNS registration is enabled).
• DNS name resolution.

This achieves the same effect as manually setting the “Primary DNS suffix of this computer” during deployment, integrated into Terraform’s provisioning workflow.

---

References:

• Policy CSP - ADMX_DnsClient
• How to configure DNS dynamic updates in Windows
• Configure a workgroup availability group
• How to enable or disable DNS updates in Windows