1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

DNS AD-Intergrated Zones

Discussion in 'Network Infrastructure' started by hippy, Jan 8, 2009.

  1. hippy

    hippy Kilobyte Poster

    307
    5
    40
    Morning all,

    With AD to AD zone do they automatically refresh or does the notify window need to be set up? Or do they only refresh based on the refresh setting in the SOA record?

    Thanks,
     
  2. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    AD should automatically refresh based around your replication schedule. You can use Replmon which can be found in Windows Support Tools on your Server 2003. On this you can do lots of things like:

    - Monitor Replication
    - Force Replication

    It should be covered in the MS Press Book, however a quick guide is located here
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  3. hippy

    hippy Kilobyte Poster

    307
    5
    40
    cheers craigie, True the replication monitor would replicate all partitions in AD.

    Ok so based off NTDS the replication will happen betwen 1 to 4 times are hour by default and it will be an IXFR transfer for DNS. But you can still force a zone transfer or replication by pressing the increment button?

    Im just confused if the notify in zone transfers (which AD intergrated zones do not really need) is still used? I can see it being used for secondary zones, but not sure if it still a valid option to AD to replicate the DNS zone as soon as a change appears.

    Maybe i should read something else and come back to this later....
     
  4. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    For the AD zones you can control the replication in AD sites and services.

    Basically if you have two DCs in one site the AD replication is instant however if you configure another DC on another site you can configure a replication schedule.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  5. hippy

    hippy Kilobyte Poster

    307
    5
    40
    cheers sparky,

    ok so AD zone to secondary zone i can set the refresh interval on the SOA or the notify window in the zone transfer tab.

    Site 1 :AD zone on ServerA (domain1.local) to AD zone ServerB (domain1.local) is the SOA record refresh interval used for anything? Is the Notify window from zone transfers used for anything (e.g. instead of waiting for the replication schedule it does a transfer straight away)?

    I see how the SOA record and all the rest of it is used in the normal primary, secondary etc... zones. Just not 100% sure on the AD intergrated zones. Although i have a funny feeling i am just confusing matters.
     
  6. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    The configuration for zone transfers is different than replicating AD integrated zones so I can see why you are trying to get a better understanding of how it all works. :biggrin

    Few linkies that might help mate..

    AD zone replication: http://technet.microsoft.com/en-us/library/cc779655.aspx

    AD zone serial number: http://support.microsoft.com/default.aspx/kb/282826
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  7. hippy

    hippy Kilobyte Poster

    307
    5
    40
    AD intergration (DNS): http://technet.microsoft.com/en-us/library/cc737383.aspx

    cheers sparky,

    Ok then, so to double check.

    The whole zone is not replicated and only the records that have changed.
    The replicating of the DNS zone is done based on AD replication setting.
    The SOA serials are checked to see whether anything needs updating on the Second DC. If the replication SOA serial is higher then replicate.

    Just to check with the replication on a single subnet, single site, 2 dc environment the replication of the DNS zone (partition it is in) between the two servers is it done as soon as a change is done (Serial has been increased)? Or based on the NTDS setting for AD replication?

    Im enjoying this :):oops:
     
  8. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    The whole zone is not replicated and only the records that have changed.
    - Yes, I believe this was an improvment over Windows 2000 DNS replication

    The replicating of the DNS zone is done based on AD replication setting.
    Yes.

    The SOA serials are checked to see whether anything needs updating on the Second DC. If the replication SOA serial is higher then replicate.
    - I believe so. I do remember having to change a serial number to force replication when I was troubleshooting a DNS problem a while ago.


    Just to check with the replication on a single subnet, single site, 2 dc environment the replication of the DNS zone (partition it is in) between the two servers is it done as soon as a change is done (Serial has been increased)? Or based on the NTDS setting for AD replication?

    If you have the two DCs in the same site then the replication is fairly instant, I havent had to worry about replication when the DCs are on the same site. If you want to control the replication you need to create site and also a site link as you may have multiple routes between sites (e.g leased lines and perhaps an ADSL backup)

    I just logged onto a DC I have setup and noticed that there is a schedule in the NTDS set for 'once per hour' but the change do replicate quicker than that. hmmmmmm! :hhhmmm

    Will need to check your last question...

    Should help mate..

    http://technet.microsoft.com/en-us/library/cc728010.aspx

     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  9. hippy

    hippy Kilobyte Poster

    307
    5
    40
    ok so when you edit a dns record in an AD zone you can say it is automatically replicated (close enough), but the partition the DNS zone is in is also replicated as per normal schedule (NTDS).

    MY brain is in working order today lol. The SOA record in the zone is used to tell the secondary zone of the AD zone when to refresh etc.... but if the serial is incremented it immediately transfers to the secondary zone.

    I tell you what finishing the 70-291 book ina week including the labs but not the question chapters at the end really turns your brain to mush for a little while lol.

    p.s. the SharkWater documentary is very interesting.

    Edit: Forgot to say cheers for the reply again!
     
  10. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    Intra-site replication is instant. If the DCs are located in different physical locations then you can configure a replication schedule.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  11. hippy

    hippy Kilobyte Poster

    307
    5
    40
    Ok cool. Think ive got it now.
     
  12. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    No probs mate. Dont know if you have the kit to do it but setting up a couple of DCs can help when you are trying to learn DNS etc.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  13. hippy

    hippy Kilobyte Poster

    307
    5
    40
    At the moment ive got 1 Dc, 1 member server, 2 x xp clients

    got RRAS NAT/dhcp relay/vpn dial in, DHCP (with superscope for xp vpn dial in client and relevant routing options with dhcp relay), DNS (AD zone primary, secondary, stud zone, delegated zone)


    *bridged connection* - DC (AD/dns/rras(NAT, vpn dial in)) - LAN segment 1 - member server (dns,rras(dhcp relay)) - LAN segment 2 - xp client

    then *bridged connection*(for vpn) - xp client2

    Will add another 2 DC: 1 just on the local subnet so as not to confuse replication and another DC connected for site and services via L2tp/ipsec just wish i had a CA. Maybe another cert book will inform me how to set up a temp CA.

    May stick 3 of the servers in a triangle with RRAS running and turn on a routing protocol.

    so little time so much to play with :D
     
  14. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    That’s a good lab for the 70-291. If you can get another DC on an another subnet then you can play with AD sites and settings.

    Looking at it from a cert point of view a CA is covered in the 70-293 and AD sites and services is covered in the 70-294.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010

Share This Page

Loading...