Re: More Event ID 5781

From: Kevin D. Goodknecht [MVP] (admin_at_nospam.LSAOL.COM)
Date: 04/01/04 

Date: Thu, 1 Apr 2004 09:40:21 -0600

In news:uz8uJ$%23FEHA.2600@TK2MSFTNGP12.phx.gbl,
Robb Edge <Robb.Edge@savant.co.uk> posted a question
Then Kevin replied below:
<snip>
> Why cant i run both BIND and DDNS on windows server for AD?
> Or is this a just Microsoft making it awkward unless your a full on
> MS site, ie MS for everything, including DNS.

I'll try to explain this, is the DC is going to be able to register in the
BIND?
The DC is going to try to register it's records in what ever DNS server it
is using in its NIC. Since you are using the BIND DNS in the NIC that is
where it is going to try to register all of its records. It also has to
register its A records in the BIND, too.
You have the delegated subzones so it should be able to register its SRV
records which is fine but is it going to be able to register its A records?

Believe me it will work fine just pointing the DC and the Member to
themselves for DNS. The rest can find them in the BIND DNS which is all that
is necessary. If you really must use the BIND only on the DC and Member, I
suggest you delegated their host names to the MS DNS servers, too. But this
is not much different than pointing the DC and member to them selves.

You will be better off and more secure to point the DC to a DNS server that
has Active Directory integrated DNS server. This is only available on the DC
however new in Win2k3 it can replicate the zone to the member DNS through
Active Directory IIRC, one of the options on the Win2k3 DNS is to replicate
to all DNS servers in the forest, I believe that includes the members.

> Some one out there must be running AD like this, I know Yale do,
> since i have their set up guide, which has been invalueble(sp).
> Sorry if this last bit seems a bit negative but after more trial
> upgrades than i can shake a stick at, i just want to resolve this
> issue.

I'm not asking you to point all machines to the MS DNS just the Member and
DC, they don't need external Resolution as long as nobody is using them as
a workstation or DNS resolver in their NIC. If they need external resolution
set the BIND as their forwarder.
Set it up the way you want but I know it will work my way, without having
the DC and Member rely on the BIND to find where they must register.
I can't tell you much more than I have about how to make Active Directory
work with BIND because BIND's DDNS is not as secure as MS DNS if you are
going to allow the DC to register in the BIND. 

-- 
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
============================
-- 
When responding to posts, please "Reply to Group"  via your
newsreader so that others may learn and benefit from your issue.
To respond directly to me remove the nospam. from my email.
==========================================
 http://www.lonestaramerica.com/
==========================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
 http://home.in.tum.de/~jain/software/oe-quotefix/
==========================================
Keep a back up of your OE settings and folders with
OEBackup:
 http://www.oehelp.com/OEBackup/Default.aspx
==========================================

Relevant Pages

  • Re: external DNS
    ... How would I get my DNS server registered? ... Please reply with the corresponding IP addresses and I will register ... > creating a DNS host, and create a DNS host named NS1 in the ...
    (microsoft.public.win2000.dns)
  • Re: Event ID 1812 on AV server
    ... Failed to Register Host A Records ... DNS server list: ... have been a problem negotiating valid credentials with the DNS server ... No DNS Name Resolution If DHCP Client Service Is Not Running ...
    (microsoft.public.windows.server.networking)
  • Re: DNS not updating
    ... The reason the system could not register these RRs was because the DNS server failed the update request. ... Are the machines or the DHCP server expected to register these stations? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Home webserver...
    ... DNS server. ... This is GOOD but irrelevant to the functioning of the DNS server. ... DNS Zone which is set to allow dynamic registrations but not ... going to register the www.swvoice.com.au. ...
    (microsoft.public.windows.server.dns)
  • BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer)
    ... BIND 8 EOL and BIND 8 DNS Cache Poisoning ... this is a different attack from BIND 9 DNS cache poisoning. ... BIND 8 caching DNS server and force users who use this DNS server to ...
    (Bugtraq)