Anyone Here know Domain and DNS Configuration? - IT WORKS!!!

[bigbearbear]

If you prefer to keep using the router as a DHCP server and you cannot customize the DNS setting on the router DHCP server, here's what you can do:

1. On the DNS server running on the Domain Controller, set the Fowarders to your router (192.168.1.1). You get there by right-clicking on the domain controller name in the DNS management console and right-click > Properties > Forwarders tab. This will allow the DNS server on your domain controller to resolve domain names that are on the internet and not in your Active Directory.

2. On Windows workstations, you can leave the IP address setting on Automatic (DHCP) but enter a static DNS, in your case, 192.168.1.10. This will make the workstations use the DNS server running your domain controller.

3. Now when you join a computer/server to the Active Directory, their host name can now be automatically resolved by any workstations using your domain controller DNS server (192.168.1.10).

4. If you have a host name that you need to create manually, you can edit the DNS server record and enter it manually. To do this, open the DNS server management console, open the Forward Lookup Zones tree, right-click your Active Directory domain and select New Host. You can then manually add in the desired host name and the IP address that it should resolve into.

Note:
If you just changed the DNS setting on the workstation, you might need to flush the DNS cache. Open a command prompt (admin mode) and enter: ipconfig /flushdns

[ke6guj]

I agree with the above that suggest that you have the DC do the DHCP and DNS and turn off DHCP on the router..


In addition, I'd suggest changing your network ID from 192.168.1.x to something else. If you keep it at 192.168.1.x and you ever want to do any dial-in VPN connections to it, you'll likely run into problems accessing those network resources from the other side of the VPN. reason being is that most home routers use 192.168.1.x as the network ID and it won't work to have the same network ID on both sides of the tunnel.

My work network was like that and I had to reprogram every worker's home router to a different network ID that needed to be able to VPN in.

[goodlookin1]

Ok guys, thanks for continuing to try and help me out.

Here's what I tried yesterday:

1) Set router to static IP
2) Changed default IP address to never been used IP
3) Changed Server name to never been used name
4) Uninstalled AD DC and DNS, and Reinstalled AD DC, DNS and DHCP
5) Did the wizard in server 2012 for Domain creation/configuration. Chose Server 2008 R2 this time. Went without issue.
6) Verified the DNS entries were automatically created (domain.local AND _msdcs.domain.local)
6) Shouldnt matter, but I also created the reverse lookup zones
7) Found that A Host had not been created for the server, so I created the "A Host" record to point to the new server IP (192.168.1.3) with the corresponding PTR record for the reverse lookup.
8) Set static IP on server as 192.168.1.3, set subnet mask, default gateway to be the same as the router, and set the DNS server to point to itself (192.168.1.3). Later came back and it showed 127.0.0.1, so it was definitely pointing to itself.
9) Went into DHCP and configured the scope:
- Lease pool starts at 192.168.1.100 - 192.168.1.254
- Subnet Mask set to 255.255.255.0
- Default Gateway set to 192.168.1.3
- DNS set to 192.168.1.3
- No secondary DNS
Saved and refreshed a separate workstation to grab from the new DHCP server. It grabbed it and was working perfectly. Internet access working.
10) Verified DNS was active and running, internet active and running on both the server and workstation

I finally go to test. Ran "DCDIAG /TESTNS" in CMD as administrator - Failed to connect. Could not run LDAP, no error message given. I then tried "PING DOMAIN.LOCAL" - Could not find server, no response, timeout, etc. Then tried "NSLOOKUP 192.168.1.3" - Server unknown. Active and found, but no name.

One strange thing: When I went into the Forward Lookup Zones and edited the NS and SOA records, if I edited the section of the FQDN and resolved the server name, it would come up with 3 different outcomes: "::1", "169.254.x.x" (which would never get verified), and "192.168.1.3" (which would verify as "OK"). That middle entry caused some concern. I ended up deleting that entry anyhow, but why would it resolve to that dreaded, bogus IP?

I just dont get it. At one point yesterday, I was able to ping the domain.local from both the server and workstation after I inserted the A Host record for the server....this was all before I uninstalled and added DHCP (it was still coming from the router), but I was not able to join the workstation to the Domain (cant remember the exact error....basically it said it could not be contacted). Since then, I have uninstalled and reinstalled all the services for DNS, AD DC, and DHCP. Now I cannot even get it back to complete a simple ping successfully even with the A records created.

Oh and by the way, my router/firewall IS able to give off a different DNS. I had set it to give the workstations the 192.168.1.3 address (the DC IP) and verified that it was correct on the WS, but it still didnt allow me to ping the FQDN.


Jason95357, thank you very much for the comprehensive response. I will run those tests tonight when I get back to the office. I will forward the results. In the mean time, if you have any additional info from what I just wrote above, I'm all ears.

d4v0s, I might just have to take you up on the Teamviewer thing!

Thanks again, guys.

[Deadsouls]

Did you disable DHCP on the router?

Also, double-check the Windows firewall on the server. Make sure it is allowing DNS, DHCP, LDAP, etc.

[goodlookin1]

Did you disable DHCP on the router?

Also, double-check the Windows firewall on the server. Make sure it is allowing DNS, DHCP, LDAP, etc.

I set router to Static (no longer giving off DHCP) and verified it (my workstation went down immediately after saving).

Firewall is completely turned off during this installation period. I know of no other area on the server that would disable any of those services....

[Deadsouls]

Could you paste the output of "ipconfig /all" from both your server & client?

Run the above from the command prompt.

[goodlookin1]

Could you paste the output of "ipconfig /all" from both your server & client?

Run the above from the command prompt.

Yeah, I can do that, but it will have to wait until this evening

I'm currently at my day job

[the86d]

Sometimes Server 2008 R2 x64 can change MAC reservations back to what they were before you updated a new MAC in DHCP for some reason, and has done this to other members of our department (replication issue, maybe?). However, I trust my home router's DHCP more than Windows'.

Could you set the DNS on the router to the DC for the primary, if it allows for this...? That should resolve DNS to the DC 1st, and on the DC put in the external that the router had before making the change (4.2.2.2, 4.2.2.64, or use googles, but the ISP's DNS would already have a bunch of cached/resolved DNS for Internet DNS)... in theory?

[goodlookin1]

Sometimes Server 2008 R2 x64 can change MAC reservations back to what they were before you updated a new MAC in DHCP for some reason, and has done this to other members of our department (replication issue, maybe?). However, I trust my home router's DHCP more than Windows'.

Could you set the DNS on the router to the DC for the primary, if it allows for this...? That should resolve DNS to the DC 1st, and on the DC put in the external that the router had before making the change (4.2.2.2, 4.2.2.64, or use googles, but the ISP's DNS would already have a bunch of cached/resolved DNS for Internet DNS)... in theory?

Well, I could do that I suppose....I know it does allow this. But if the workstation's DNS is already set to the DC, and the DC has the forwarder set to the Router and the internet is working, isn't it safe to conclude that the normal mode of operation, as DNS goes, is working properly? I mean, if the only DNS the workstation is pointed to is the DC, how can it go to any other DNS?

It seems that DNS isnt working properly, but at the same time, I have it all set right. It's almost as if the Domain is non-existent or turned off...

[d4v0s]

Two things

Did you set the gateway on the server to be the router ip? It sounded like you said you set it to be the same as the router meaning the next hop 1.1 perhaps which would be the modem? Make sure its the routers ip.

Thing two, turning off a windows firewall causes weird issues almost every time I do it. Try turning it on but allowing all programs in or out.

Just thought of another thing, did you try the /registerdns switch on the clients?

[goodlookin1]

Did you set the gateway on the server to be the router ip? It sounded like you said you set it to be the same as the router meaning the next hop 1.1 perhaps which would be the modem? Make sure its the routers ip.

Yes, I set the server to the Router's IP address: 192.168.1.1
The Workstation's gateway is the DHCP server: 192.168.1.3

Thing two, turning off a windows firewall causes weird issues almost every time I do it. Try turning it on but allowing all programs in or out.

Interesting, I've never ran across this, but I dont have a problem trying that.

Just thought of another thing, did you try the /registerdns switch on the clients?

I tried the "ipconfig /flushdns" on the server, but I have not done the "ipconfig /registerdns" on the clients. I will do this today.

Having said that, I cannot even ping the FQDN from the server, so there is something else going on....something outside of networking and internal on the server.

[d4v0s]

Your workstations gateway should be the router. I think that will fix everything.

[goodlookin1]

Your workstations gateway should be the router. I think that will fix everything.

The router is no longer giving off the DHCP, the server is. The workstation should still have the router's gateway even with this setup? I thought with the server now doing DHCP, it would also become the gateway?

Even still though, shouldnt the server be able to ping its own domain?

[the86d]

Well, I could do that I suppose....I know it does allow this. But if the workstation's DNS is already set to the DC, and the DC has the forwarder set to the Router and the internet is working, isn't it safe to conclude that the normal mode of operation, as DNS goes, is working properly? I mean, if the only DNS the workstation is pointed to is the DC, how can it go to any other DNS?

It seems that DNS isnt working properly, but at the same time, I have it all set right. It's almost as if the Domain is non-existent or turned off...

Linux has less DNS problems, which is why most routers don't run Windows.

OS's like Win Vista and 7 have the weirdest DNS and networking issues... I think it is because M$ thinks they put in foolproof traps, that fail when you do everything right...
Even Windows 2000 Pro and Servers had weird issues here and there, they are just more prevalent these days.

[ocabj]

Running DHCP services off a DC is unnecessary. DHCP and DNS are technically independent of one another. If you already have an existing appliance or server that is providing DHCP leases, turning that off and lighting it up on the DC doesn't really bring you any closer to a solution to this issue.