In this video from ITFreeTraining I will look at how DNS is used with Active Directory.
Active Directory cannot work without DNS; clients use DNS to find services records on
the network like Domain Controllers. Once you finish watching this video you will understand
why Active Directory requires DNS. I will now change to my Domain Controller
NYDC1 and have a look at the DNS records that have been created for this domain.
First of all, I will open Server Manager from the quick launch bar. Once open, I will select
the tools option and then select DNS to open the DNS admin tool.
If I expand downwards I will get to the Forward Look Up zone ITFreeTraining.local. If I expand
ITFreeTraining.local you can see there are a number of different folders. These are created
automatically. To understand how the records in these containers
work, I will have a look inside one of them, in this case, the container underscore TCP.
In here, you can see that there are a number of DNS records are present. On this network
there are currently 2 Domain Controllers so this means that there are 4 DNS records for
each Domain Controller. At the top, you can see the DNS record with
underscore GC and in the data part LADC1.ITFreeTraining.local. This DNS record is basically saying that there
is a Global Catalog available on the server LADC1.
Under this you can see a second DNS record called underscore GC. In the data section
for this DNS record is NYDC1.ITFreeTraining.local. You can see that the client only needs to
request the DNS record underscore GC. When it requests this DNS record underscore GC
it will obtain the IP Address for a global catalog in the domain ITFreeTraining.local.
You can see using this method the client can find out the IP Address of a global catalog
server without having to know any information about the Domain itself. All the client needs
to know is where to look for the DNS record. Below this you can see that other records
that exist for Active Directory services. For example, the next one down is the DNS
records of Kerberos. These DNS records allow the client to find Domain Controllers on the
network that can perform authentication using Kerberos.
The next DNS record is underscore KPasswd. This DNS record indicates the location of
a service on the network that is able to perform Kerberos Password changes.
The last DNS record is underscore LDap. These DNS records indicate the location on the network
of servers on the network that can perform LDap look ups in Active Directory. You can
see by these DNS records, it is just a matter of the client querying the DNS record for
the service that they want to find a server that can provide that service.
If I open the properties for one these service records, in this case a DNS record for underscore
GC, this will show the settings configured for this DNS record. Service records like
these are essential for allowing clients to find Active Directory services on the network
like Domain Controllers and Global Catalog Servers. You should now understand why Active
Directory requires DNS in order to operate. Without it, clients cannot locate servers
on the network that provide Active Directory Services.
Service records contain a number of different settings. Some of these DNS settings can be
changed after the DNS record is created, for example, the priority of the DNS record. It
should be remembered that these DNS records are created automatically and you should not
need to be changed. I am simply going through the settings to give you a better understanding
of how service records work. Service records with a low priority setting
are used before the service records with a higher priority record. When there are two
or more service records with the same priority, the next value, weight is used. All the weights
of all the DNS records are added together and divided by how many there are to decide
which service record is used. To understand how this works, consider these
4 service records. 3 of the service records have the priority of 0 and the last one has
a priority of 1. When the clients request the service record, DNS will return one of
the service records with the lowest priory value, which in this case is 0. The next question
is, out of the 3 service records, which one does it return?
To determine this, DNS will add up the weights of all the service records, which in this
case will give a total of 200. Now when the client requests the service record, it is
a matter of deciding out of these 3 service records which one will be used.
To do this, the weight is divided by the total which gives a percentage. As you can see,
the first service record will be used 50% of the time, and the 2nd and 3rd service records
will be used 25% of the time. The fourth service record will not be used because the value
of the priority for the fourth value is higher than the other 3.
You can see how the priority and weight values are used together to determine which service
records are used by the client. The next value in the service record is the
port number used by the service. Even though you can change the value of these records,
as we will see in a moment, these DNS records are automatically created and thus any changes
you make will be overwritten later on. The purpose of this demonstration is to give you
a better understanding of how Active Directory requires services records in order to operate.
On a production environment, you should not need to modify these records.
Below this is the host offering the service record. Notice also the tick box, “Delete
this record when it becomes stale” is ticked. This means that the service record will eventually
expire and be removed from the DNS server assuming that scavenging is enabled on the
DNS server. This is how DNS will remove old service records when servers like Domain Controllers
are removed from the network. To demonstrate this, I will go back DNS Manager
and then delete all the service records. Since this is not a production network I can afford
to do this, but I would not recommend that you do something like this on a production
network. Deleting service records like these on a production network will mean that clients
on the network will not be able perform functions like authentication and logon to the network.
I will now go back to Server Manager and from tools select services. I will than restart
the service “Active Directory Domain Services”. This will in turn restart 4 other services.
What restarting these services does is force these services to register any DNS records
that they require in the DNS server. The process requires all 4 services to be
stopped and then started again. This does take a bit of time so I have sped up the video
so we do not need to wait. Once the services have restarted, I will go
back to the DNS Manager. No service records are visible, however you will notice that
if I press F5 to refresh the view they will now appear.
Notice there are 4 services records for the Domain Controller NYDC1. The Domain Controller
LADC1 has not appeared as yet. In time, the services on the LADC1 Domain Controller will
reregistered their service records on the DNS server and LADC1 will also appear. If
you do not want to wait for this to occur you can always restart the services like I
did on NYDC1. The point to remember is that this will only
occur if dynamic updates are enabled on the zone file. To check this, I will right click
on zone and select the properties option. In the properties for the zone, notice that
dynamic updates is configured for secure only. This is an important fact to remember. If
you do not have dynamic updates enabled and if there are changes made to a Domain Controller
the service records will not be updated. A simple change like changing the IP address
of the Domain Controller will require the service record to change. If the service records
does not change, clients will not be able to locate the Domain Controller.
The next point to remember is that if you do not have dynamic updates enabled and you
have scavenging enabled, scavenging will, given enough time, remove all your service
records from the DNS server and thus prevent clients from being able to locate Active Directory
services on the network. When Supporting Active Directory, it is best to leave dynamic updates
enabled so that your clients will always be able to find Domain Controllers and other
services even if changes are made to your network.
The services records that I have looked at so far are found under underscore TCP. This
means that these service records are used by the clients when reliable transmission
is used. If I look under the container underscore UDP,
there are service records for Kerberos and KPassword that refer to the Domain Controllers
LADC1 and NYDC1. If the client wanted to connect to these services using unreliable communication,
it would look in the DNS server in this container. Under this are the two containers DomainDNSZones
and ForestDNSZones. These are used with Active Directory Application partitions. You can
see there is a lot of information that the client can use for locating resources on the
network using DNS, however all these so far have been linked to the domain, in this case,
the client would need to know to look under ITFrreeTraining.local for this information.
There is also another zone created called underscore MSDCS. This is a zone file created
for Microsoft clients. Remember that there are other non-Microsoft directory services
that use LDAP. Without this zone, a Microsoft client would not know if they were obtaining
a service record for a Microsoft or a non-Microsoft directory service.
The next reason why this zone is required is that it contains information for all domains
in the forest. The first domain you create in the forest will become the root domain
and this zone will be named after that. So essentially this is the MSDCS zone for the
ITFreeTraining.local forest. So essentially you have a zone file that contains service
records for all services in the forest. Why is this important? For Active Directory replication
to occur correctly this needs to happen at the domain and forest level. For this reason,
all Domain Controllers requires knowledge of all Domain Controllers in the forest so
that they can configure replication correctly. Using this zone, they can obtain this information
and configure replication correctly.
You can start to see why DNS is so important to Active Directory. One trick that I like
to do when replication has failed on a Domain Controller, in particular a new Domain Controller,
I like to change the DNS settings on the Domain Controller to point to a DNS server that is
up to date. By doing this, the Domain Controller can obtain the correct information and configure
replication correctly. Once replication has occurred, I can change the DNS setting back
to the local server.
If I expand downwards, notice there are a number of different folders. In the folder
underscore TCP notice there are service records for the two
Domain Controllers currently running in the forest. All the information for the forest
is listed in here. For example the client can find out not only the locations of Domain
Controllers, but can also find out information about which sites are configured. All this
information is required by a Domain Controller when configuring a replication system that
works at the forest level and this is why this zone is required and is so important.
This video has looked at how DNS and service records work with Active Directory and there
has been a lot of information covered.
The main points to remember is that service records are required for clients to find Active
Directory resources. These service records need to be present in your DNS server. These
can be created using dynamic updates or manually. If you do create the service records manually,
for example you use a DNS server that is not Microsoft, you will need to manually update
these if there are changes on your network like add, removing and changing the IP Address
of Domain Controllers. The last point to remember is that if you
enabled scavenging in DNS, scavenging is covered in another video and is the process of removing
DNS records from DNS that have not been updated after a period of time, make sure that dynamic
updates is enabled if scavenging is enabled. If dynamic updates are not enabled and the
DNS records are eligible for scavenging, the DNS records will be removed and the clients on
the network will not be able to access resources on the network.
After watching this video you should have a good understanding of how the service records
and dynamic update are used to allow clients to find Active Directory Resources.
Thanks for watching this free video from ITFreeTraining. Just one of the always free videos. See you
next time.