DNS Server 2008

DNS Troubleshooter Related to DNS Administration

shilpesh_desai — Tue, 20 Jan 2009 03:51:00 GMT

Permissions Issues

What to check for:

To perform DNS server administration, i.e. change DNS server parameters, a user must have FULL CONTROL permissions on the MicrosoftDNS container in Active Directory. Users who are members of the following groups have these permissions by default – Enterprise Admins, Domain Admins, and DNSAdmins. See KB article 313526.
To perform zone administration in Windows 2000, i.e. change zone parameters, a user must have FULL CONTROL permissions on the zone object within the MicrosoftDNS container in Active Directory. Users who are members of the following groups have these permissions by default – Enterprise Admins, Domain Admins, and DNSAdmins.

Note: It is not possible to allow a user to make changes to a zone and yet keep them from possibly deleting the zone.

To allow a user to read the server and/or zone parameters but not change them, they must have READ permissions on the MicrosoftDNS container and/or the Zone object.
If ACLs have been modified on zone, you can reset the zone security to the default using the following command:

Dsacls cn=MicrosoftDNS,cn=system,dc=example,dc=com /S /T

(this is for a domain called example.com)

For Windows 2003, you need to have Read control of the MicrosoftDNS container. The AD DACL (Discretionary Access Control Lists) will dictate permissions.

DNS Not Scavenging Stale Records

What to check for:

Verify that DNS Scavenging is enabled in the server Advanced properties. See KB article 296116
Verify that the zone in question has scavenging/Aging enabled.
Verify that the record(s) have a timestamp. In the DNS MMC, select View\ Advanced and then right-click the record and select properties.
Record time stamp must be older than the combination of the No-refresh + Refresh intervals to be subject to scavenging. Be aware that automatic scavenging of the zone will not occur until the DNS Server service has been running for a period of time equal to the Refresh Interval set on the zone.
To initiate a scavenge manually, in the DNS MMC, right-click on the DNS server and select “Scavenge stale resource records”.
If no one updates record between No-refresh + Refresh intervals, record will be marked as stale, and will be removed from DNS MMC but will exist under MicrosoftDNS container. “dNSTombstone” attribute will change to “True” when record become stale.
If a large number of records do not have a timestamp and are in need of having one set (to be subject to scavenging), the dnscmd utility can be used to accomplish this. Note: using this utility to force the aging of all records in a zone will cause records for hosts that are not dynamically updated to eventually be scavenged from the zone. USE THIS WITH CAUTION: The /ageallrecords will affect all records within DNS, even manually added records.

dnscmd /ageallrecords

DNS Troubleshooter Related to Active Directory Issues

shilpesh_desai — Tue, 20 Jan 2009 03:10:00 GMT

DC Promotion/Demotion Fails

What to check for:

If joining a domain controller to a domain, verify that the current domain controller(s) do not have disjointed namespace; see KB article 257623.
If promoting or demoting a server in an existing domain, verify SRV records are properly registered in the forward lookup zone. As an initial check, verify that the following four folders exist directly beneath the root or child domain: _msdcs, _sites, _tcp, _udp

Some examples of records that should be registered in the DNS zone are:

_ldap._tcp.dc._msdcs.

_ldap._tcp.._sites.dc._msdcs.

_kerberos._tcp.._sites.dc._msdcs.

If some or all of the previous records are missing, verify the following:

Verify that the Kerberos Key Distribution Center service is started on the Domain Controller
Verify that the Netlogon Service is started on Domain Controller
Verify that the DHCP Client service (W2K3) & DNS Client service (W2K8) is started on Domain Controller
Verify that the domain controller has a host record registered
If Domain subfolders are missing, see KB article 310568 .

Replication Issues

What to check for:

Verify domain controllers that are replication partners in the domain have their global universal ID (GUID) registered in the forest root zone.

Example of an NTDSA object GUID record:

name = e99e82d5-deed-11d2-b15c-00c04f5cb502._msdcs.domain.com

type = cname

data = server.domain.com

Note: Every Windows 2000/2003 domain controller registers a CNAME record corresponding to the GUID of its NTDSA object (example above) in the forest root domain, regardless of whether the domain controller is in a child domain, or a different tree of the forest. The forest root domain is the first domain created in the forest.

· Domain controllers attempting to replicate initiate a query to Active Directory for their configured replication partner and GUID. They then initiate a DNS query for the cname record for the GUID, similar to the record in the example above. If the GUID is not present in the DNS zone, the domain controller will not replicate with that partner.

· Each domain controller must also have a host record registered for their name (cname) in the DNS zone

· Verify that both domain controllers involved in the replication can resolve the above DNS records for each other.

If there are replication problems in the forest root zone, verify that domain controllers are not pointing to themselves for DNS. As a rule for Windows 2000, only one Domain Controller in the forest root domain should be pointed to itself for either Preferred or Alternate DNS server in their TCP/IP properties setting, and all other domain controllers should be pointed to DNS servers other than themselves. See KB article 275278. For Windows 2003, it is preferred to point to themselves for Preferred and to another Domain Controller server as we have moved _MSDCS folder to forest wide replication and GUID information will be available locally on domain controllers.

Logon Slow or Failed

What to check for:

Usually associated with failed logon 5719 Event log error. See KB article 244474.
Verify host is not pointing to an ISP’s DNS server for Preferred or Alternate.
A host that is logging on must be pointed to a DNS server that can resolve records for local domain and forest root.
If logon is in a child domain, insure child is properly delegated from parent zone if applicable. See KB article 255248.

Unable to connect to RDP option available via TSWeb

shilpesh_desai — Mon, 12 Jan 2009 08:33:00 GMT

1. Client connects to TS Web using URL –https://tsgateway.domain.com/ts

2. Once they logon to TS Gateway, we click on “Remote Desktop Option”

3. We Provide Machine name or IP Address or FQDN to connect to internal machine and get’s following error,

“This Computer can’t connect to the remote computer.

Remote Desktop cannot find the remote computer. Type the computer name or IP address again, and then try connecting. If the problem continues, contact the owner of the remote computer or your network administrator.”

4. If you double check RAP policies it will look in good shape.

The behavior can occur if TS Web Server have no idea about TS Gateway Server name, even though TS Web and TS Gateway services runs on same box, to fix this following below steps,

a. Open up IIS Manager

b. Expand Sites and Default Web Sites

c. Expand TS and under ASP.NET , double click Application Directory

d. Edit value called “DefaultTSGateway” and set value of FQDN of TS Gateway Server (External name if we are using different names)

Brief Explanation about New DNS Features in Windows Server 2008

shilpesh_desai — Mon, 12 Jan 2009 08:03:00 GMT

1. DNS Server Role – DNS server service is now implemented as a Server Role using Server Manager. Which mean DNS is no longer installed via Add/Remove Windows Components.

2. Background Zone Loading - Microsoft has changed the way DNS loads zone data from Active Directory. Sometimes the DNS server can take an hour or more to load the data with extremely large zone data. The result is that the DNS server is unable to serve the client's requests for entire time it takes to load AD based zones.

A DNS server running Windows Server 2008 now loads zone data from AD in the back ground while it restarts so that it can respond to requests for data from other zones. Example – If you have 10 zones and data for first 3 zones data already loaded properly while it is loading other zone data, the DNS server can respond to the client’s request as expected for first 3 zones.

Because the task of loading zones is performed by separate threads, the DNS server is able to respond to queries while zone loading is in progress.

Another advantage of storing data in AD rather than in a file -namely that the DNS Server service has the ability to respond to requests immediately. When the zone is stored in files, the service must sequentially read through the file until the data is found.

3. Support for IPv6 – DNS Servers running on Windows Server 2008 now support IPv6 as fully as they support IPv4 addresses. Which mean IPv6 support is available with DNS MMC as well as with tools. Example, IPv6 address can be displayed in Server Forwarder list or DNSCMD.exe tool accepts addresses in either format.

4. Support for Read Only Domain Controllers (RODC) – To Support RODC, DNS server running Windows Server 2008 support a new zone type called the Primary Read-Only Zone. When computer becomes RODC, it will get read only copy of all the application partitions that DNS uses. The Administrator of RODC can view contents of DNS but will unable to change it from RODC machine.

5. GlobalNames Zone – Organization deploy WINS as secondary name resolution protocol along with DNS as they rely on global names which are unique & single-label. WINS requires NetBIOS over TCPIP and it do not support IPv6.

To assist organization to move to all-DNS environment, DNS server in Windows Server 2008 now supports a new zone called GlobalNames. Typically the replication scope for this zone is entire forest, which ensures that zone has the desired effect of providing unique, single-label names across forest.