Domain Network Systems (DNS) Information

SID filtering

2009-12-13T10:17:00.000-08:00

An administrator in a trusted domain can modify the SID history for a user, which could grant her elevated privileges in the trusting domain. To prevent this from happening you can enable SID Filtering for a trust. When SID filtering is enabled, the only SIDs that are used as part of a user's token are from those domains in the trust path of the trusted domains. if the trusted domain is dns-info.blogspot.com which has a child domain called child.dns-info.blogspot.com, SID Filtering would accept SIDs from both the dns-info.blogspot.com.com domain and its child domain.

Change SOA Record

2009-03-01T22:07:00.000-08:00

The following illustrates on how to change SOA record.

1. Assume the domain is "myrootdns2003.com" and dns server is "dnssserver2003".
2. Open dns using the command dnsmgmt.msc.
3. In the console tree, browse to dns zone "myrootdns2003.com", right click on it and select properties.

4. In dns zone properties dialog, go to "Start Of Authority(SOA)" tab, enter the FQDN of primary dns server "dnsserver2003", responsible person and serial number as shown below.

5. Thus changes the SOA record on domain controller.

Create SRV record

2009-03-01T08:34:00.000-08:00

Service (SRV) record. Allows administrators to use several servers for a single DNS domain, to easily move a TCP/IP service from one host to another host with administration, and to designate some service provider hosts as primary servers for a service and other hosts as backups. DNS clients that use a SRV-type query ask for a specific TCP/IP service and protocol mapped to a specific DNS domain and receive the names of any available servers.

The following shows on how to create SRV record

1. Assume the dns server is "dnsserver2003" and dns zone to which the srv record to be added is "myrootdns2003.com"
2. Open dns management snap-in console using the command dnsmgmt.msc.
3. In the console tree, go to the dns zone "myrootdns2003.com", right click on it and select "other new records"

4. Select "Service Location (SRV)" in new resource record type dialog and click "Create Record" button.

5. Enter the SRV server details in new resource record dialog, and select "Allow any authenticated user to update all dns records with the same name" check box and click ok.

6. Thus creates new srv record.

Netdom - Verify Trust

2009-03-01T07:22:00.000-08:00

It is often needed to verify a trust relationship, particularly external trust relationship, is working properly before using any cross domain network resources. To verify a trust on command line. do the following.

1. Assume the trusting and trusted domains are "myrootdns2003.com" and "myforesttest.com" respectively and passwords are "Mydns123" and "Myforest123".
2. Now run the below command to verify the external trust.

netdom trust myrootdns2003.com /domain:myforesttest.com
/userd:myforesttest\Administrator /Passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /verify

3. To verify trust relationship between Active Directory based windows domain and non-windows realm kerberos domain (Assume the kerberos realm password is "Mytrust123"), run

netdom trust myrootdns2003.com /domain:myforesttest.com
/userd:myforesttest\Administrator /Passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /verify /Passwordt:Mytrust123

reset trust relationship

2009-03-01T05:32:00.001-08:00

When a trust relationship is broken, then it is necessary to reset the trust relationship. The following illustrates on how to reset a broken domain trust relationship.

1. Assume the trusting domain name is "myrootdns2003.com" and trusted domain is "myforesttest.com".
2. Open "Active Directory domains and trusts" Console diagram using the command "domain.msc".
3. Right click on domain node "myrootdns2003.com" and select properties.

4. In "myrootdns2003.com" properties dialog, select the domain "myforesttest.com" and click properties.

5. Click validate button in "myforesttest.com" properties dialog.

6. If validation fails, a dialog box comes to reset the trust relationship. Then follow up with the dialog box and complete the resetting.

netdom - reset trust

2009-03-01T01:48:00.000-08:00

If a trust relationship between two domain is broken, then it is necessary to reset the trust. netdom.exe is a command tool which can be used to reset the trust. Follow the steps below to reset the trust.

1. Assume the trust exists between the domains "myrootdns2003.com" and "myforesttest.com". Passwords of both the domains are "Mydns123" and "Myforest123" respectively.

2. Now run the below command to reset trust.

netdom trust myrootdns2003.com /domain:myforesttest.com /userd:myforesttest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /reset

3. If the trust is between windows domain and non-windows realm (kerberos) , then run the below command to reset the trust,

netdom trust myrootdns2003.com /domain:myforesttest.com /userd:myforesttest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /reset /Passwordt:Mytrust123

Note, the passwordt has to be provided to reset the trust with Kerber0s realm.

Register SRV Record

2009-02-28T22:09:00.000-08:00

By Default, SRV records are automatically created one the domain controller is installed.
If srv records not found or invalid, try the following mitigation to manually register dns srv records.

1. Restart NetLogon server on domain controller (DC).
2. If step 1 fails, then run dcdiag /fix and check srv records are registered.
3. if both 1 and 2 fails, run netdiag /fix on domain controller.
4. if , 2 and 3 fails, then try manually editing netlogon.dns. i.e add srv record to netlogin.dns as shown below.

After editing the netlogon.dns file, reload the dns zone as shown below.

If none of the above works, still one can register srv records, by recreating dns zone. Follow the instructions shown below to recreate dns zone.

1. Assume the dns zone is "myrootdns2003.com"
2. Open dns management console using dnsmgmt.msc command.
3. In the dns console tree, go to forward lookup zones, right click on dns zone. "myrootdns2003.com" and click delete.

4.After deleting dns zone, right click on "forward lookup zones" and select "newzone" and follow the steps to recreate same dns zone. i.e dns zone with name "myrootdns2003.com"
5. while re creating new zone, “Allow Secure and Non Secure Dynamic updates" option in dynamic updates dialog.

6.Now restart netlogon service.

Add NS Record

2009-02-28T20:34:00.000-08:00

NS record is also called as Name Server record. To Add NS record to a dns, do the following.

1. Assume the dns server for the domain "myrootdns2003.com" is "dnsserver2003".
2. To open dns manager snap-in, run the dnsmgmt.msc command on dns server "dnsserver2003".
3. In console tree, traverse to the dns zone "myrootdns2003.com", right click on zone and select properties.

4. Go to the Name Servers tab in properties dialog and click Add Button.

5. Now enter the FQDN of the name server "dnsserver2003.myrootdns2003.com" in Name Server text box and click resolve in resource record dialog.

6. Verify the name server is resolved to its ip address "192.168.1.100" and click ok.

7. Verify the name server is added to name server dialog, click apply and then click OK.

Delete dns record

2009-02-28T19:27:00.000-08:00

To remove a dns resorce record, follow the instructions shown below.

1. Assume the domain dns zone is "myrootdns2003.com", dns server is "mydnsserver2003".
2. Open dns management console using the command dnsmgmt.msc.
3. In dns manager console window, browse to the dns zone "myrootdns2003.com", click it, see the list dns records in the right pane, select the desired dns record to removed, right click on it and select "delete".

manage trust using netdom

2009-02-27T23:04:00.000-08:00

Netdom.exe is a tool which is used for managing domain workstations in a domain and trust relationships between domains.
This post discusses on adding,removing and managing trusts between domains(forests).

To Create an external trust (External trust is a trust relationship between domains of different forests):

External trust can also defined as a trust between an active directory(AD)domain to Windows NT Domain or to external forest is called external trust. Follow the instructions shown below to add external trust from AD domain to forest or Windows NT domain.

1. First, assume the trusting domain is "myrootdns2003.com", trusted domain is "mytestforest.com", trusting domain administrator password is "Mydns123" and trusted domain(forest) administrator password is "Myforest123".

2. Now run the simple command shown below to add trust from "myrootdns2003.com" to "mytestforest.com".

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123 /add

Output:To improve the security of this external trust, security identifier (SID)filtering is enabled. However, if users have been migrated to the trusteddomain and their SID histories have been preserved, you may choose to turnoff this feature.
For more information about SID filtering and how to turn it off, see the helpfor netdom trust /FilterSids or see Help and Support.
The command completed successfully.

Suppose if you want to provide trusting domain passwords along with the trusted domain password, which is needed in a situation like creating trust from a remote machine, to create trust, then run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123
/usero:myrootdns2003\Administrator /passwordo:Mydns123 /add

If you can also create trust without passing passwords by running the command below

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /add

In the above, passwords will be asked interactive for making connections with trusting and trusted domains.

All the above created trusts are one way trust. This is because, By default trust between two domains of different forests is one-way. However a two-way external trust can be created with the option /two-way. See below

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /add /two-way

The /Quarantine option is used to Set the domain quarantine attribute in an exiting trust. i.e if it is "yes", then only SIDs from the directly trusted domain will be accepted for authorization. SIDS from any other domains will be removed. Specifying /Quarantine without yes or no will display the current state.
To set Quarantine for an existing trust, run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes"

To list routed name suffixes in an exiting external trust, then run

netdom trust myrootdns2003.com /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes" /NameSuffixes:mytestforest.com

Note: 1. trust name is "mytestforest.com" from trusting domain "myrootdns2003.com"
2. /Domain option is not required
3. One find trust name using the command netdom query as shown below.

netdom query /domain:myrootdns2003.com /userD:myrootdns2003\Administrator /passwordd:* trust

To change the status of a routed name suffix of a trust, then do run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes" /ToggleSuffix:1 /NameSuffixes:mytestforest.com

Here the no#1 specifies the first name suffix status to be changed.

To allows users migrated to the trusted forest from other forest to access resources in this forest using SID history, run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /EnableSIDHistory:"yes"

Bydefault, disables migrated users in the trusted forest to use SID history to access resources in this forest.

To specify selective authentication across the external trust, then run

netdom trust myrootdns2003.com /domain:mytestforest.com /userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /SelectiveAUTH:"yes"

To create with a non-Windows Kerberos realm, run (Assume the target non-windows kerberos domin is mytestforest.com)

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123
/usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass"

Here /PasswordT is the New trust password needed for windows domains to make any changes, updates or resets made to this trust.
To allow the external trust to be created for only one of the domains, then run trust create command wiht /oneside option.

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass" /oneside:trusted

Thus the above allows the trust to be created or remove for "trusted domain" only.

To specify the Kerberos authentication protocol should be verified between windows and non-windows domains, run

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass" /Kerberos

To remove the trust, just run the below command

netdom trust myrootdns2003.com /domain:mytestforest.com /userD:mytestforest\ Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /remove

Domain trust

2009-02-26T22:05:00.000-08:00

A domain trust is a relationship between domains which allows users of one domain to access services of other domain.

By default, users of a domain can have access to resources contained in that domain. i.e domain users can use domain resources like network printer, fax service and any network share. However, users of one domain cannot access resources of other domain. By this way, a domain can provide its users with secured access to all resources in that domain. If all users accounts and services can be managed in a single large domain, then there is no problem. However, there are needs to have multiple separate domains. This is because having multiple domains is a useful way to separate the scope of each domain administrator from other domain administrators. i.e Each domain administrator is responsible for setting up scope of security policy and account policy settings on domain users and domain resources. Thus both multiple domain and trusts between domains are needed.

Trust mechanism in windows

A domain trust(trust relationship) is a relationship between two domains to allow authentication and authorization to shared resources. In authentication process, verifies the user identity and in authorization process determines what the authenticated user is allowed to do on shared network resource on target computer. i.e Once the user is authenticated by the domain containing shared network resource, the target computer compares the user’s credentials to the permissions assigned within its security descriptor table to help determine the user’s level of authorization to the shared resource. A security descriptor table contains access control lists (ACLs) that identify the users and groups that are assigned or denied access permissions on shared resource.

Trusts in Active Directory:

Domains that have domain controllers running Windows 2000 Server or Windows Server 2003 used Active Directory service. Windows NT and earlier windows versions doesn't have active directory service support.

Trust Relationship types:

The direction that a trust is assigned determines the trust path used for authentication. A trust path is defined by the series of trust relationships that authentication requests must follow between domains.

The following are the domain trust relationship types characterized by the trust path used for authentication.

One-Way Trust
A one-way trust is a unidirectional trust between two domains. i.e in one-way trust between a trusted domain and a trusting domain, trusted domain users or computers can access resources in the trusting domain. However, the trusting domain users cannot access resources in the trusted domain. Some one-way trusts can be either nontransitive or transitive, depending on the type of trust being created.
Two-Way Trust
A two-way trust is a bidirectional trust between two domains. i.e users of either domain can send authentication requests to other domain. Some two-way relationships can be either nontransitive or transitive depending on the type of trust being created.

All domain trusts in an Active Directory integrated forest are two-way, transitive trusts. When a new child domain is created, a two-way, transitive trust is automatically created between the new child domain and the parent domain. This is not true with domains not integrated with active directory service(windows NT and earlier versions).

Trust Transitivity
Transitivity determines whether a trust between two domains can be extended beyond the two domains. A transitive trust extends trust relationships to other domains. Every time a domain created in a forest, a two-way transitive trust is created between the new domain and its parent domain automatically. The trust path flows upward through the domain hierarchy, extending the initial trust path created between the new domain and its parent.

Transitive trust relationships thus flow upward through a domain tree. Therefore a domain tree can be defined as a hierarchical structure of one or more domains, connected by transitive, bidirectional trusts, that forms a contiguous namespace.

So with transitive trusts, user accounts of any domain in the forest can be authenticated by any other domain in the forest. Consequently, with a single logon process, accounts with the proper permissions can access resources in any domain in the forest happens.

Nontransitive trust
In this, The flow is restricted to the two domains in the trust relationship and nontransitive trust does not extend trust relationships to other domains in the forest. A nontransitive trust can be either a two-way trust or a one-way trust. By default, Nontranstive Trusts are not created. On must explicitly create those.

Various Trust Deployment methodologies

There are three trust deployment strategies that are used to accommodate the resource sharing needs of an enterprise. These are intra-forest, inter-forest and Kerberos realms based trusts.

Intra Forest Trusts

Intra-forest trusts are transitive trusts that can be used only within a single forest. i.e trust can't be created across multiple forests. Intra-forest trusts includes tree-root, parent-child, and shortcut trust relationships.

Tree-root trusts

By default, two-way, transitive trusts are automatically created when a new domain is added to a domain tree or forest root domain. But when a new domain tree is created in an existing forest, then a new tree-root trust is established. tree-root trusts are two-way and transitive.

Parent-child trusts

A new parent and child trust is established when ever a new child domain is created in a domain tree. Trust flows from child domain to parent domain and goes upwards till domain tree.

Shortcut trusts

Shortcut trusts are the trusts established between two domain trees within the same forest. By Default, Authentication requests must first travel a trust path between domain trees, and in a complex forest this can take time. Using shortcut trusts can create trust with domains in other domain trees. Thus authentication requests goes through shortcut trust which increases overall speed.

Inter Forest Trusts

Inter-forest trusts can be created between domains contained in different forests. Inter-forest trusts can be nontransitive or transitive. Inter-forest trusts include external trusts and forest trusts and both these trust types should be created explicitly.

External trusts

External trusts are nontransitive which can be created between domains in different forests or between an Active Directory domain and a Windows NT 4.0 domain.

Forest trusts

Forest trust is a trust relationship between two forests. Forest trusts can be a one-way or two-way transitive. A two-way forest trust is used to form a transitive trust relationship between every domain in both forests. Forest trusts can be created only between two Windows Server 2003 forests and cannot be implicitly extended to a third forest.

Kerberos Realm Trusts

A realm trust can be established between any non-Windows-based operating system Kerberos version 5 realm and a Windows 2000 or Windows 2003 domain. This trust relationship allows cross-platform interoperability with security services based on other Kerberos version 5 implementations. Realm trusts can be either one-way or two-way.

Clear dns client cache

2009-02-26T02:42:00.000-08:00

To delete staled or expired dns entries at a dnsclient, run the following command on dns client machine

ipconfig /flushdns

Note: Cleaning Dns Server cache is different. To clear cache at server side go to Flush server side cache

install dhcp on command line

2009-02-26T01:53:00.000-08:00

The following illustrates on how to install dhcp server using sysocmgr.exe command. sysocmgr.exe is used to install windows optional components.

1. Create a unattended file unattend.txt with the following content

[NetOptionalcomponents]
DHCPSERVER=1

2. Now run the command below to install dns server automatically.

sysocmgr.exe /i:sysoc.inf /u:"unattend.txt" /f

3. To install dhcp silently i.e without UI, run
sysocmgr /i:sysoc.inf /u:"unattend.txt" /f /q

4. Also to install dhcp on multi-language environment, run

sysocmgr /i:sysoc.inf /u:"unattend.txt" /f /q /i

how to Install DHCP

2009-02-26T00:35:00.000-08:00

The following illustrates on how to install dhcp server.

1.Open Add/Remove windows optional component dialog using the command "control appwiz.cpl,,2"

2. In the windows component dialog, select "networking services" and double click on it.

3. Select " Dynamic host Configuration Protocol(DHCP)" in networking services dialog and click ok.

4. Now click next in "windows components" dialog.

5. Click finish. That's completes installing dhcp server

Relevant Posts:
Install DHCP Automatically on command line

Add DHCP Snap-in to mmc

2009-02-26T00:31:00.000-08:00

To add DHCP Manager add-on to MMC do the following

1. launch mmc using the command mmc

2. In the console window, open File click Add/Remove Snap-in.

3. In the Add/Remove SnapIn dialog, click add button.

3. In the Stand Alone Add/Remove SnapIn dialog select "DHCP" and press Add button.

Thats it the add-in for DHCP Manager SnapIn is added to MMC

import zone from a file

2009-02-25T22:15:00.000-08:00

To import a zone from a .dns file, do the following

1.Assume the dns server is "dnssever2003" and the zone to be created is "myrootdns2003.com".
2. Open dns manger snap-in using the command dnsmgmt.msc.

3. In the console tree, traverse to the forward lookup zone, right click on it and select "newzone".

2. Click next in new zone wizard

5. Select "primary" if one wishes to create Primary zone or select secondary zone or stub zone and then click next.

6. Enter zone name "myrootdn2003.com" in zone name dialog and click next.

8. Enter zone file "myrootdns2003.com.dns" from which to load zone om zone file dialog and click next.

9. Select "Do not allow dynamic updates" in dynamic updates dialog and click next.

9. Verify the final settings in the summary dialog and click finish.

import reverselookup zone from file

2009-02-25T21:16:00.000-08:00

To import a reverselookzone from a file, follow the instructions shown below.

1. Assume the dns server is "dnsserver2003" and reverse lookup zone is "1.168.192.in-addr.arpa"
2. Open dns manger snap-in using the command dnsmgmt.msc.

3. In the console tree, browse to reverse lookup zone, right click on it and select "newzone" and click next

4. Click next in zone wizard

3. Select "primary" if one wishes to create Primary zone or else select secondary zone or stub zone and then click next.

5. Select "all dns servers in the active directory domain myrootdns2003.com" in zone replication scope dialog and click next.

6. Enter the network id "192.168.1" in reverse lookup zone name dialog and click next.

7. Select "Use the existing file" option and enter "1.168.192.in-addr.arpa.dns" in zone file dialog and click next. Make sure the file "1.168.192.in-addr.arpa.dns" exists at %windir%\system32\dns

7. Select "Do Not allow dynamic updates" in dynamic updates dialog and click next.

8. Verify the settings in summary dialog and click next.

Export reverse lookup zone using dnscmd

2009-02-25T19:58:00.000-08:00

Do the following to export reverse lookup zone on command line. 1. Assume the primary dns server for the dns (domain controller) is "dnsserver2003" and the reverselookupzone file to be created is "reverselookupzone.dns"
2. Now run the below command to export reverselookup zone on command prompt.

dnscmd dnsserver2003 /zoneexport 1.168.192.in-addr.arpa reverselookupzone.dns.

Output: DNS Server . exported zone 1.168.192.in-addr.arpa to file C:\WINDOWS\system32\dns\reverselookupzone.dns Command completed successfully.

3. To export the zone from current cache, then run
dnscmd /zoneexport 1.168.192.in-addr.arpa /cache

output:DNS Server . exported zone
1.168.192.in-addr.arpa to file C:\WINDOWS\system32\dns\/cache
Command completed successfully.

Export reverse lookup zone

2009-02-25T19:35:00.000-08:00

The following illustrates exporting reverselookup zone to a file,
1. Assume the dns server for domain "myrootdns2003.com" is "dnsserver2003"
2. Open dns manger snap-in using the command dnsmgmt.msc.

3. in the console tree, browse to the reverse lookup zone, right click on it and select "export list".

3. Enter the file name to which the zone to be exported in save dialog box.

Relevant Posts:
Export reverse lookup zone on command line
Create Reverse Lookup zone from file

How to Join a domain

2009-02-25T06:47:00.001-08:00

To join a machine to a domain, follow the instructions shown below.
1. Assume the domain to which this machine going to be joined is "myrootdns2003.com".
2. Open mycomputer, right click on it and select properties.

3. In mycomputer properties, go to Computer Name tab, click on "change" button.

4. Enter domain name "myrootdns2003.com" in to which this machine will join in Compute Name Changes dialog and click ok.

5. Enter user name and password which has privileges to join in target domain and click ok.

6. Thus domain join success pop up dialog comes up.

Relevant Posts:
Join a target domain on command line

Enable Secure and NonSecure updates on a zone

2009-02-24T22:45:00.000-08:00

To enable both the secure and non secure updates on a zone follow the instructions below.

1. Assume dns server which is acting as a domain controller(DC) for a dns say "myrootdns2003.com" is "dnsserver2003", zone name on which to enable secure/nonsecure updates in "myrootdns2003.com".
2. Open dns management console using the command dnsmgmt.msc

3. In the console tree, browse to the dns zone "myrootdns2003.com", right click on it and select "properties".

4. In the dns zone properties dialog, go to general tab, select "nonSecure and Secure" option in the dynamic updates drop down box.

Enable Secure DynamicUpdates on reverselookup zone

2009-02-24T22:12:00.000-08:00

Follow the instruction below to enable secureupdates on a reverselookup zone.

1. Assume the dns server on which the DNS (DomainController) is installed is "dnsserver2003" and reverse lookup zone is "1.168.192.in-addr.arpa".
2. open the dns management console snapin using the command dnsmgmt.msc.

3. In the console tree, browse to the reverse lookup zone, right click on it and click "properties"
tr>

3. In the reverse lookup zone properties dialog, go to the general tab and select "secure only" option from Dynamic updates drop down box, click apply and then click ok button.

reload reverselookup zone

2009-02-24T21:36:00.000-08:00

To reload or update a reverselookup zone, follow the instructions below.

1 Assume the dns server (DC) is "dnsserver2003" and reverse lookupzone is which is going to be updated is "1.168.192.in-addr.arpa".
2. Open dns management console using the command dnsmgmt.msc.

3. In the dns manager snap-in, go to the reverse lookup zone "1.168.192.in-addr.arpa", right click on it and select "reload" menu item.

4. Click yes button is reload dialog box.

5. Thus reloads the reverselookup zone.
Relevant Posts:
Reload Reverselookup on command line

DNS_ERROR_ZONE_LOCKED

2009-02-24T21:21:00.001-08:00

Command failed: DNS_ERROR_ZONE_LOCKED 9607 (00002587)

The above error occurs when trying to reload a zone using dnscmd.

This means the dns zone didn't allow dynamic updates.

1. To enable Dynamic updates using dnscmd , follow the instructions cite at Allow Dynamic Updates
2. To enable dynamic updates using dns manager snapin, follow the instructions at Enable Scure and nonsecure updates on a zone

Failed to reload the zone

2009-02-24T21:19:00.000-08:00

The Failed to reload the zone zone is locked for zone trasfer or update error occures when trying to update a zone on which dynamic updates is disable.

To enable dynamic updates on a zone, follow the instruction at Enable Updates on a zone.

remove machine from domain using netdom

2009-02-24T20:48:00.000-08:00

To unjoin a dns client machine from it's domain on command line, do the following

1. Assume the domain to be joined is "myrootdns2003.com", machine name which is going to join domain "myrootdns2003.com" is "dnsclient", domain user account name is "Administrator" and password is "Mydns123", dnsclient machine user account and password is "Administrator" and "dnsclient123".
2. Now run the following command to remove machine from the domain,

netdom remove dnsclient /domain:myrootdns.com /userd:Administrator /passwordd:Mydns123 /usero:Administrator /passwordo:dnsclient123

3. To un-join machine with reboot option (say 100secs restart time), run

netdom remove dnsclient /domain:myrootdns.com /userd:Administrator /passwordd:Mydns123 /usero:Administrator /passwordo:dnsclient123 /REboot:100

reload reverse lookup zone using dnscmd

2009-02-24T18:51:00.001-08:00

To reload reverselookup zone on command line using dnscmd command, follow the instructions below.

1. Assume the dns server on which to reload the zone is "dnsserver2003" and reverselookup zone name is "1.168.192.in-addr.arpa".
2. Now run the below command to update the reverse lookupzone.
dnscmd dnsserver2003 /zonereload 1.168.192.in-addr.arpa

Join domain using netdom

2009-02-24T10:07:00.000-08:00

The following illustrates on how to join a domain on command line.

1. Assume the domain to be joined is "myrootdns2003.com", machine name which is going to join domain "myrootdns2003.com" is "dnsclient", domain user account name is "Administrator" and password is "Mydns123", dnsclient machine user account and password is "Administrator" and "dnsclient123"

2. Now run the following command to add the machine "dnsclient" to the domain "myrootdns2003.com"

netdom join dnsclient /domain:myrootdns.com /userd:Administrator /passwordd:Mydns123 /usero:Administrator /passwordo:dnsclient123

To specify the reboot time (say 100 secs) after joining domain, run

netdom join dnsclient /domain:myrootdns.com /userd:Administrator /Passwordd:Mydns123 /usero:Administrator /passwordo:dnsclient123 /REBoot:100

The reboot message box comes up

Notes: 1. Check the domain "myrootdns2003.com" and FQDN dnsserver2003.myrootdns2003.com is pingable from dnsclient machine.
2. Sometimes firewall blocks from joining domain. So Check the firewall is disabled before joining.
3.NetDom needs access to ports 135 and 139 for joining domain. Check that the target domain machine listens on these ports.
4. Check the reg key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\EnableLUA to 1
Relevant Posts:
Un-join client from domain on command line

Dynamic Host configuration Protocol

2009-02-23T21:40:00.000-08:00

Dynamic Host configuration Protocol (DHCP) allows configuring dynamic assignment of IP addresses and network parameters to hosts which are necessary for a host computer to communicate on an IP network. The benefits of using DHCP are that a network administrator is not required to re-address machines moving from one location to another, nor is a network administrator required to manually configure all IP options for each machine joining the network.A DHCP-enabled machine joining the IP network sends out an IP broadcast message asking for an address, and obtains a valid IP address for the network as well as any other needed configuration options associated with the given address.
The DHCP Server in Windows Server 2003 and 2008 as well earlier versions (2000) consists of several aspects including but not limited to: a service process, several management tools , and a database that tracks IP addresses and the machines to which they are given.

Relevant Posts:
How to Install DHCP
Add dhcp snap-in add-on to mmc

Create external trust

2009-02-23T00:10:00.000-08:00

The following illustrates on how to create trust between two domains.

1. Assume the local domain is "myrootdns2003.com" and target domain to which the trust to be created is "mydnsroot2.com".
2. Open the active directory domains and trust snapin using the command domain.msc.

3. In the left pane, right click on the domain "myrootdns2003.com" and select properties.

4. In the domain properties dialog, go to trusts tab and click "new trust" button.

5. Type the NetBIOS name of the NT domain or the DNS name of the AD domain( here "dnsserver2") in the trust name dialog and click next.

6. Select "Two-way " option in direction of the trust dialog and click next.

7. Select "Both this domain and specified domain" option in sides of trust dialog and click next.

8. Enter administrative user name and password for target domain "mydnsroot2.com" and click next.

6. Verify the summary and click next.

7. Thus creation of new trust completion dialog comes up. now click click next.

8. Select "No, do not confirm outgoing trust" option and click next.

9. Thus completes creation of new trust.

10. Thus verify trust created in "trusts" tab of domain properties dialog.

Create Group Policy Object (gpo)

2009-02-22T22:10:00.000-08:00

The following illustrates creating gpo object using active directory wizard.

1. Assume the domain "myrootdns2003.com".

2.Open group policy snap in using the command gpmc.msc.

2. In the console tree, browse to the node Group Policy management -> Forest:myrootdns2003.com -> domains -> myrootdns2003.com -> group policy objects, right click on "group policy objects" and select new.

3. Enter the name of the new gpo to be created and click ok.

Require Domain Users To Elevate when setting a network location policy

2009-02-22T21:19:00.000-08:00

This policy setting determines whether to require domain users to elevate when setting a network's location.
If you enable this policy setting, domain users must elevate when setting a network's location.
If you disable or do not configure this policy setting, domain users can set a network's location without elevating.

To enable the policy, do the following
1. Open group policy using the command gpedit.msc
2. Browse to the node Computer Configuration -> Administrative Templates -> Network -> Network Connections.

3. Click Enabled in "Require Domain Users to elevate when setting a network locations" dialog.

Raise Functionality Level of Forest

2009-02-20T23:40:00.000-08:00

The following illustrates on raising the functionality level of windows 2003 forest.
1. Assume the domain name is "myrootdns2003.com".
2. Open domain snapin using the command domain.msc.

3. In the left pane, right-click on Active Directory Domains and Trusts and select Raise Forest Functional Level

4. Select "Windows Server 2003" in the list box and click raise button.

To retrieve forest level, run the command
dsquery * myrootdns2003.com -scope base -attr msDS-Behavior-Version

Raise Functionality Level of a Windows Server 2003 on command line

2009-02-20T22:20:00.000-08:00

The following illustrates changing domain functionality level on command line.
1. Assume the domain is "myrootdns2003.com".
2. Create a file raise_domain_func_level.ldf with the following contents
dn: myrootdns2003.com
changetype: modify
replace: msDS-Behavior-Version
msDS-Behavior-Version: 2
-
3. Now run the following command to change the functionality level.
ldifde -i -f raise_domain_func_level.ldf

4. Alternatively, admod tool can also be used to change functionality level.
admod -b dc=myrootdns2003,dc=com "msDS-Behavior-Version::2"

5. Also using vbscript functionality level cab be changed, The following snippet changes functionality level to windows 2003.


strDomain = "myrootdns2003.com"
' ------ END CONFIGURATION ---------

set objDomain = GetObject("LDAP://" &  strDomain)
objDomain.GetInfo
if objDomain.Get("msDS-Behavior-Version") <>
Wscript.Echo "Changing domain to  
Windows Server 2003 functional level … "
objDomain.Put "msDS-Behavior-Version", 2
objDomain.SetInfo
else
Wscript.Echo "Domain already at Windows Server 2003 functional level "
end if

DNS Mixed Mode Vs Native Mode

2009-02-20T22:00:00.000-08:00

The mode of a domain restricts OS(Operating system) of domain controllers (DCs) in that domain to be run. In a mixed-mode domain, All Windows 2000, Windows Server 2003 and Windows NT domain controllers can run. but In a native-mode domain, Windows 2000 DCs run in windows 2000 domains and Windows Server 2003 domain controllers in windows 2003 domain.

Mixed mode imposes following limitations:

1. The domain cannot contain Universal security groups.

2. Groups in the domain cannot have their scope or type changed.

3. The domain cannot have nested groups (aside from global groups in domain local groups) 4.Account modifications sent to Windows NT BDCs, including password changes, must go through PDC Emulator for the domain.

5. The domain cannot use SID History.

The domain mode can be changed only from mixed to native mode. But not vice-verse.

Only by restoring entire Active Directory environment from a previous backup can go to mixed mode.

Raise Functionality Level to windows 2003

2009-02-20T21:57:00.000-08:00

To raise the functionality level to windows 2003, do the following.
1. Assume the domain is "myrootdns2003.com".
2. Open ActiveDirectory domain and trust snap-in using the command domain.msc.

3. In the left pane, right click on the domain and select "raise domain functionality level"

4. Select "Windows Server 2003" in the list box in the "Raise Domain Functionality Level" dialog and click "Raise" Button

Relevant Posts:
Raise Functionality Level On command prompt

Change Domain Functionality Level using script

2009-02-20T21:54:00.000-08:00

The following snippet illustrates changing domain functionality level to windows 2000.


strDomain = "myrootdns2003.com" ' e.g. amer.rallencorp.com

set objDomain = GetObject("LDAP://" &  strDomain)
if objDomain.Get("nTMixedDomain") > 0 Then
Wscript.Echo " 
Changing mode to native … "
objDomain.Put "nTMixedDomain", 0
objDomain.SetInfo
else
Wscript.Echo "Already a native mode domain"
end if

Change Domain Functional Level to windows 200 native mode on command line

2009-02-20T21:35:00.000-08:00

The following illustrates on how to changes domain functional level to windows 2000 on command prompt.

1. Assume the domain name "myrootdns2003.com".
2. Create a file say change_domain_mode.ldf with the following contents.
dn: myrootdns2003.comchangetype: modify replace: ntMixedDomain ntMixedDomain: 0
3. Now run the below command to change the functionality level to windows 2000 mode.
ldifde -i -f change_domain_mode.ldf

4. Alternatively, use the admod command to change the functionality level.
admod -b dc=myrootdns2003,dc=com "ntMixedDomain::0"

Get domin netbios name using script

2009-02-20T20:08:00.000-08:00

The following vb script shows finding netbios name

1. Assume the domain name is "myrootdns2003.com"

strDomain = "myrootdns2003.com"
' ------ END CONFIGURATION --------

set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
strADsPath = ";"
strFilter = "(&(objectcategory=Crossref)" & _
"(dnsRoot=" & strDomain & ")(netBIOSName=*));
strAttrs = "netbiosname;"
strScope = "Onelevel"
set objConn = CreateObject("ADODB.Connection")
objConn.Provider = "ADsDSOObject"
objConn.Open "Active Directory Provider"
set objRS = objConn.Execute(strADsPath & strFilter & strAttrs & strScope)
objRS.MoveFirst
WScript.Echo "NetBIOS name for " & strDomain & " is " & objRS.Fields(0).Value

View NetBios Name on command line

2009-02-20T18:21:00.001-08:00

Run the following command to find the netbios name of a domain.

dsquery * cn=partitions,cn=configuration,dc=myrootdns2003,dc=com -filter "(&(objectcategory=crossref)(dnsroot=myrootdns2003.com))" -attr netbiosname

adfind tool can also be used to find netbios name of a domain.

adfind -b cn=partitions,cn=configuration,dc=myrootdns2003,dc=com -f "(&(objectcategory=crossref)(dnsroot=myrootdns2003.com))" cn netbiosname

Find NetBios Name of a Domain

2009-02-20T06:41:00.000-08:00

The following illustrates on how to find NetBios name of a domain.

1. Assume the domain name "myrootdns2003.com"
2. Open domain snapin using the command domain.msc.

3. Right-click the domain in the left pane and select Properties.

4. Domain Name is NetBios Name of the domain.

Net Bios name can also be viewed using LDP Snapin.

1. Open LDP on command prompt.

2. from the menu, select Connection -> Connect.

3. Enter the name of a domain controller , port 389 and click OK.

4.From LDAP menu, select Connection -> Bind.

5. Enter Domain User, Password and domain name and click OK.

6.Again From LDP menu, Select Browse -> Search

7. Enter "cn=partitions,cn=configuration, dc=myrootdns2003,dc=com", "subtree" and "(&(objectcategory=crossref)(dnsHostName=dnsserver2003)(netbiosname=*))" in BaseDN, Scope and Filter respectively.

Relevant Posts:
Find domain netbios name on command line
Get Netbios Name using VBScript

List domains in a forest using script

2009-02-20T05:30:00.000-08:00

The following code displays the domains contained in a forest.

1. Assume the foresst root is "microsoft.com"

strForestRoot = "microsoft.com" ' i.e., dc=microsoft, dc=com
strADsPath = ";"
strFilter = "(netbiosname=*);"
strAttrs = "dnsRoot;"
strScope = "SubTree"
set objConn = CreateObject("ADODB.Connection")
objConn.Provider = "ADsDSOObject"
objConn.Open "Active Directory Provider"
set objRS = objConn.Execute(strADsPath & strFilter & strAttrs & strScope)
objRS.MoveFirst while Not objRS.EOF
For Each root in objRS.Fields("dnsRoot").Value
WScript.Echo(root)
Next objRS.MoveNext
wend

Find domains in a forest on command line

2009-02-20T05:06:00.000-08:00

To findout list of domains in a forest through command prompt, do the following

1. Assume the dns server (Domain Controller) is dnsserver2003.
2. Now run the below command to list the domains contained in a forest.

ntdsutil "d m" "sel op tar" c "co t s dnsserver2003" q "l d" q q q

3. Dsquery command also be used to view the domains, just run the below command.
dsquery * -filter "objectcategory=domainDNS" -scope subtree

Third party tools like adfind can also be used to find domains in a forest.
adfind root s subtree f "objectcategory=domainDNS" -dn

Find domains in a forest

2009-02-20T04:57:00.000-08:00

To view all the domains in a forest, do the following.

1. Open domain snap-in wizard using the command domain.msc.

2. In the left pane of domains console tree shows the list of domains in the forest.

Relevant Posts:
List Domains on command line
List domains using VB Script

Remove Orphaned Domain

2009-02-20T04:56:00.000-08:00

To remove a domain that was orphaned may be because the domain was forcibly removed, or the last domain controller in the domain failed to uninstall completely or improperly removed.

The following illustrates on how to remove an orphaned domain

1. Assume the domain controller (dns server) of the orphaned domain is "dnsserver2003"

2. Now run the below command to forcibly remove orphaned domain.

ntdsutil "meta clean" "s o t" conn "con to server dnsserver2003" q q

output: metadata cleanup: "s o t" "list domains"
 Found 4 domain(s)
 0 - DC=myrootdns2003,DC=com
 select operation target: sel domain 2
 select operation target: q
 metadata cleanup: remove sel domain

A message will be displayed to indicate status of the removal.

Removing an orphaned domain consists of removing the domain object for the domain (e.g., dc=myrootdns2003,dc=com), all of its child(sub domains) objects, and the associated crossRef object in the Partitions container.

Note: The above is command is shortcut form of below command

 ntdsutil "metadata cleanup" "select operation target" connections "connect to server dnsserver2003" quit quit

what is Top-level domain

2009-02-19T00:29:00.000-08:00

A string of letters used to indicate a organization or an institution.

The following is a list of the top-level domains most often used on the Internet

.arpa: This is Owned by Advanced Research Project Agency (ARPA). Used to register reverse mapping of Internet Protocol version 4 (IPv4) addresses assigned by the Internet Assigned Number Authority (IANA) to DNS domain names for computers that use those addresses on the Internet. This is used by in-addr.arpa domain.

.com: This is used for business and commercial use.

.int: Reserved for international use. Currently planned for use in RFC 1886 to register reverse mapping of Internet Protocol version 6 (IPv6) addresses assigned by IANA to DNS domain names in the ip6.int domain for computers that use those addresses on the Internet.

what is root domain

2009-02-19T00:19:00.000-08:00

root domain is a root of domain tree when used in a DNS domain name, it is stated by a trailing period (.) to designate that the name is located at the root or highest level of the domain hierarchy.

The following shows root domain.

Set GlobalQueryBlockList using dnscmd

2009-02-18T22:36:00.000-08:00

To set GlobalQueryBlockList on command prompt using dnscmd, do the following

1. Assume the dnsserver is "dnsserver2008" , domain is "myrootdns2008.com" and host name which is to be blocked from querying is "dnsclient.myrootdns2008.com"
2. Now run the command below
dnscmd dnsserver2008 /config /GlobalQueryBlockList "dnsclient.myrootdns2008.com"

3. To reset query block (remove all block listed hosts), run
dnscmd dnsserver2008 /config /GlobalQueryBlockList
4. To find block listed host names, run
dnscmd dnsserver2008 /info /globalqueryblocklist

Globalqueryblocklist Registry key

2009-02-18T22:05:00.000-08:00

The globalqueryblocklist reg key contains list of host names whose name resolution to be blocked from querying.
Key Name: Globalqueryblocklist
Type: reg_sz
Default: Doesn't exists
Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dns\parameters
Functionality: Specifies list of host names to be blocked from querying.
If a host name to be blocked from querying, then set the reg key to contain that host name.
The following shows blocking host name "dnsclient.myrootdns2008.com"
reg add HKLM\SYSTEM\CurrentControlSet\Services\dns\parameters /v Globalqueryblocklist /t reg_sz /d "dnsclient.myrootdns2008.com" /f
Relevant Posts:
Enable Global Query Block List on command prompt
Set QueryBlockList on command line

Enable EnableGlobalQueryBlockList using dnscmd

2009-02-18T21:57:00.000-08:00

To enable EnableGlobalQueryBlockList through command prompt, do the following.

1. Assume the dns server on which to enable global query block list is "dnsserver2008"
2. Now run the following command to enable EnableGlobalQueryBlockList.

dnscmd dnsserver2008 /config /EnableGlobalQueryBlockList 1

3. To disable Global Query BlockList, run
dnscmd dnsserver2008 /config /EnableGlobalQueryBlockList 0
4. To view or find status of EnableGlobalQueryBlockList, run
dnscmd dnsserver2008 /info /EnableGlobalQueryBlockList

Allows DnsSuffix Appending To Unqualified Multi-Label Name Queries Group Policy

2009-02-18T08:12:00.000-08:00

"Allows Dns Suffix Appending To Unqualified Multi Label Name Queries" Group Policy determines appending suffixes to an unqualified multi-label name if the original name query fails.

A domain name containing dots, but not terminated by dot is called an unqualified multi-label name, for example "mytootdns.cm". A fully qualified multi label name will have a terminating dot, for example "myrootdns.com.".

If this policy is enabled, if the original multi label name query fails, dns suffixes are appended to an unqualified multi-label name.
For example, an unqualified multi-label name query for "myrootdns.cm" will be queried by the DNS Client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS Suffixes configured for the computer for queries. These suffixes can be derived from a combination of the local DNS Client's primary domain suffix, a connection-specific domain suffix and/or DNS Suffix Search List.

For example, if the local DNS Client receives a query for "myrootdns.cm", and a primary domain suffix is configured as "forest.com", with this setting the DNS Client will send a query for "myrootdns.cm.forest.com."

To enable the policy, do the following
1. Open group policy editor using the command gpedit.msc.

2. In the console tree, browse to the node Computer Configuration -> Administrative Templates -> Network -> DnsClient, righ click on policy "Allows DnsSuffix Appending To Unqualified Multi-Label Name Queries Group Policy" and click properties.

3. In the properties dialog, check "Enabled" button, click apply and click OK button.

If the policy is disabled, then no suffixes are appended to unqualified multi-label name queries if the original name query fails.

If you do not configure this setting, computers will use their local DNS Client configuration to determine the query behavior for unqualified multi-label names.

Turn Off Multicase Name Resolution Group policy

2009-02-18T06:58:00.000-08:00

Local Link Multicast Name Resolution (LLMNR) is a secondary name resolution protocol, in which Queries are sent over the Link Local subnet from a client machine using Multicast to another client using same multicast(LLMNR).

This group policy determines the usage of Local Link Multicast Name Resolution(LLMNR)

If the policy is enabled, will turnoff LLMNR for all the client machines on all configured network adapters.

To enable the policy, do the following.

1. Open group policy editor using the command gpedit.msc.

2. In the console tree, browse to the node Computer Configuration -> Administrative Templates -> Network -> DnsClient, righ click on policy "Turn Off Multicase Name Resolution" and click properties.

3. In the properties dialog, click "Enabled" option button, click apply and click OK.

If the policy is disabled, will turn on LLMNR for all client machines on all available configured network adapters.

If the policy is not configured, will turn on LLMNR for all client machines on all available configured network adapters by default.

Note: This policy is available only on windows 2008 server.

GlobalNamesQueryOrder Registry key

2009-02-18T05:54:00.000-08:00

The Global Names Query Order registry key determines the order in dns query names to be resolved. By default, the DNS server, Instead GlobalNamesZone" uses it's local zone data to respond to a dns query.
Key Name: GlobalNamesQueryOrder
Type: reg dword
Default: 0(Key doesn't exists)
Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dns\parameters
Functionality: Specify the order of zones (Local Zone, GlobalNames Zone) to respond to a dns query.
if the reg key is set to 1, then GlobalNames zone is first used to resolve queries.
To set the reg value to 1, run
reg add "HKLM\SYSTEM\CurrentControlSet\Services\dns\parameters" /v GlobalNamesQueryOrder /t reg_dword /d 1 /f
Note: This reg key applies only if globalnames zone exists.

Access shared folder using a Alias (CNAME)

2009-02-18T00:39:00.000-08:00

The following describes things needs to do to access a share using an alias.

1. Assume the the alias name is "mysharealias", dns server on which the alias "mysharealias" created is "dnsserver2003" and domain name is "myrootdns2003.com", host name pointed by the Alias "mysharealias" is "myshare.myrootdns.com". To know how to create Alias(CNAME) click Here
2. Now add new alias NetBios Name to the registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v OptionalNames /t reg_sz /d "myshare"
3. Make sure the DisableStrictNameChecking reg key at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
is set to 1
4. Reboot the dns server
5.Now the share can be accessed using \\mysharealias

Find domain name

2009-02-17T23:17:00.000-08:00

To know domain name given IP address of the domain, do the following.

1. Assume the ip address of the domain is 203.145.184.33
2. Now run
nslookup 203.145.184.33

Output:
Name: ABTS-TN-Static-033.184.145.203.airtelbroadband.in Address: 203.145.184.33

Light Weight Directory Access (LDAP)

2009-02-17T18:45:00.000-08:00

Light Weight Directory Access(LDAP) is a protocol built on top of TCP/IP. LDAP facilitates directory client to access directory server and allows the client to perform directory operations and share directory data. Active Directory implements the LDAP attribute draft specifications and the IETF standards for LDAP versions 2 and 3.

LDAP provides an efficient way to access directory services without the much complexity as other directory service protocols have. LDAP defines set of operations to be performed to query and modify information in a directory and to securely access directory information. LDAP also be used to find or enumerate directory objects and to query or administer Active Directory.

Create Host A record using dnscmd

2009-02-17T09:22:00.000-08:00

The following shows adding a host A record on command prompt.

1. assume the dns server is "dnsserver", dns zone is "myrootdns.com" and host which is to be added is "dnsclient.myrootdns.com"

dnscmd dnsserver /recordadd myrootdns.com . /Aging /OpenAcl A dnsclient.myrootdns.com

To set timeout (say 20secs) for the record, run

dnscmd dnsserver /recordadd myrootdns.com . /Aging /OpenAcl 20 A dnsclient.myrootdns.com

RouteThrough (RT) Record

2009-02-15T21:15:00.001-08:00

The RouteThrough record is used to bind internal hosts which didn't have direct wide are network(WAN) address to intermediate routes. This record contains two fields. A 16-bit integer used to indicate preference for each intermediate route and the domain name of the route through host.
To create RT record through dns manager snap-in, follow the below instructions.
1.Open dns manager using dnsmgmt.msc
2.In the console tree, browse to dns zone "myrootdns.com", right click on the zone and click "new other records".

3. Select "RouteThrough(RT) Record" list item in the resource record type dialog.

4. Enter route through host and click OK in new resource record dialog.

5. Click "Done" button in resource record type dialog.

6. Verify the RouteThrough record has created in dns manager.

ATM Record

2009-02-15T19:50:00.000-08:00

The ATM Address resource record maps domain host name with ATM address. The following shows creating ATM resource record.

1. Assume the dnsserver on which to create ATM Address is "dnsserver", domain zone is "myrootdns.com".

2. Open Dns Manager using the command "dnsmgmt.msc".

3. In the console tree, go to the dns zone "myrootdns.com", right click on zone and select "Other New Records".

4. In Resource Record Type dialog, Select ATM Address list item and click "Create Record"

5. In the New Resource Record Dialog, Enter ATM address and click OK.

6. Click "Done" button in resource record type dialog.

7. In the dns manager, verify the ATM resource record created.

IPV6 Host Type AAAA Record

2009-02-15T19:01:00.000-08:00

The AAAA resource record maps domain host name with it's IPv6 address.

The following shows creating AAAA record.
1. Assume the dnsserver on which to create AAAA is "dnsserver", domain zone is "myrootdns.com" and IPv6 to be added ::(Local Address)
2. Open Dns Manager using the command "dnsmgmt.msc".
3. In the console tree, go to the dns zone "myrootdns.com", right click on zone and select "Other New Records".

4. In Resource Record Type dialog, select "IPv6 Host(AAAA)" List item and click Create Record.

5. Enter :: (Local IPv6 Address) in new resource record dialog, click OK

6. Click "Done" in Resource Record Type Dialog

7. Verify the Type AAAA created in dns manager snap-in.

Relevant Posts:
Create IPv6 Type AAAA record on command line.

Create MR Record using dnscmd

2009-02-15T18:29:00.000-08:00

The following illustrates on how to create MailBox Renamed record on command prompt using the command dnscmd.exe.
1. Asssume the dns zone is "myrootdns.com" and host name of the existing mailbox record is "dnsserver.myrootdns.com".
2. Now the command below to add MR record,
dnscmd dnsserver /recordadd myrootdns.com . /Aging /OpenAcl MR dnsserver.myrootdns.com

3. Verify the MR record created in dns manager snapin dialog.

MR Record

2009-02-15T17:39:00.000-08:00

The rename mailbox resource record represents domain mailbox which essentially the proper rename of existing mailbox name. The rename mailbox is useful in the following scenarios.

1. The renamed mailbox record can be used as a forwarder entry for a mailbox user who moved from existing mailbox to different mailbox.
2. MR records if used didn't cause additional section processing.

The following illustrates on how to create MR record.
1. Assume the dns zone to which the MR record to be added is "myrootdns.com", existing mailbox host is "dnsserver.myrootdns.com".
2. Open dns manager using the command dnsmgmt.msc.
3. In the console tree, browse to the dns zone, right click on the zone, select "other new records".

4. In the resource record type dialog, select "Rename Record(MR)" list item and click "Create record" button.

. 5. In Resource Record dialog, click browse button.

5. Browse to mailbox record and select it.

6. Verify the "replace mailbox" item in New resource record dialog and click OK.

7. Click "Done" in Resource Record Type dialog, thus Rename MailBox Record has been created.

Relevant Posts:

Create MR Record ON command Prompt

Delete Host A record using dnscmd

2009-02-15T09:16:00.000-08:00

To remove host Type A record on command prompt, do the following

1. Assume the dns domain is "myrootdns.com", dns server for the domain is "dnsserver", Host name for which the Type A record to be deleted is "dnsclient".

dnscmd dnsserver /recorddelete myrootdns.com dnsclient A /f

Create MG Record using dnscmd

2009-02-15T08:56:00.000-08:00

To add MailGroup(MG) record on command prompt, do the following.
1. Assume the domain zone in which the MG record to be created is "myrootdns.com", dns server for the domain is "dnsserver", and assume mailbox(MB) record to be added is at host "dnsserver.myrootdns.com"

2. Now run the command below to add the MG resource record at
dnscmd dnsserver /recordadd myrootdns.com . /Aging /OpenAcl MG dnsserver.myrootdns.com

MG Record

2009-02-15T06:50:00.000-08:00

The MailGroup(MG) Record allows to add domain mailboxes specified by mailbox records as members to domain mailgroup specified my mailgroup record.

Forexample, the mailbox record for the domain "myrootdns.com" can be added as a member to mailgroup record to domain myrootdns.com

The following illustrates on how to create mailgroup record

1. Assume the domain is "myrootdns.com", and mailbox host for the domain mailbox record is "dnsserver".
2. Open dns manager spapin using the command dnsmgmt.msc.
3. in the dns console tree, browse to dns zone myrootdns.com, right click on the zone, select "other new records".

4. In resour record type dialog, select "MailGroup(MG) Record" and click "create new record"

5. Add mailbox record in MailGroup Record dialog and click ok

Create MailBox(MB) record using dnscmd

2009-02-15T05:47:00.000-08:00

To add a MB record through command prompt, do the following

1. Assume the domain for which mailbox need to be created is "myrootdns.com", and host which will host the mailbox is "dnsserver.myrootdns.com".
2. Now run the below command to create MB record.
dnscmd dnsserver /recordadd myrootdns.com dnsserver /Aging /OpenAcl MB dnsserver.myrootdns.com

MB Record

2009-02-15T05:08:00.000-08:00

The MB(MailBox) record maps a domain mail box to a specified host.

For example, the domain is myrootdns.com, mail box for the domain "myrootdns.com" can be mapped to a machine say "dnsserver.myrootdns.com"

The following illustrates adding mail box record to a domain.

1. Assume the domain is "myrootdns.com", the authorize dns zone for the domain is "myrootdns.com", the server which is going to host mail box is "dnsserver".
2. Open dns manager snapin using the command dnsmgmt.msc.
3.In the console tree, browse to the dns zone "myrootdns.com", right click on the zone, select "Other New Records".

4.in the resource record type, select "mailbox" list item, click create new record.

4. Enter MailBox host name "dnsserver.myrootdns.com"

Relevant Posts:
Create MB Record Using dnscmd command

Delete MX Record Using dnscmd

2009-02-14T22:55:00.000-08:00

Do the following command to delete a MX record on command prompt,
1. Assume the dns zone is myrootdns.com, dns server is "dnsserver", mail server node is "mailserver"

dnscmd dnsserver /recorddelete myrootdns.com mailserver MX /f

Create MX Record using dnscmd

2009-02-14T21:52:00.000-08:00

The following illustrates on how to add mx record on command prompt using dnscmd
1. Assume the dns server "dnsserver", dns zone name is "myrootdns.com" and mail server is mailserver.myrootdns.com

dnscmd dnsserver /recordadd myrootdns.com mailserver /Aging /OpenAcl MX 10 mailserver.myrootdns.com

NS (name server) record

2009-02-14T06:26:00.000-08:00

A Name Server (NS) record allows to delegate a child domain to a dns server. For example, Assume myrootdns.com is the main domain, subdomain.myrootdns.com is the subdomain and childdnsserver.myrootdns.com is server machine which should act as name server for subdomain.myrootdns.com

Create NS Record using dnscmd

2009-02-14T04:05:00.000-08:00

The following illustrates on how to add NS (Name Server) to a dns on command prompt.

1. Assume the subdomain is "subdomain.myrootdns.com", parent domain is "myrootdns.com", parent domain's dns server is "dnsserver", the name server (dns server) for subdomain.myrootdns.com is "childdnsserver.myrootdns.com" .
2. Now run the below command to add NS for "childdnsserver" at "myrootdns.com" dns zone.

dnscmd dnsserver /recordadd myrootdns.com subdomain /Aging /OpenAcl NS childdnsserver.myrootdns.com

To set timeout(20) for the record, run

dnscmd dnsserver /recordadd myrootdns.com subdomain /Aging /OpenAcl 20 NS childdnsserver.myrootdns.com

To remove NS reocord, run

dnscmd dnsserver /recorddelete myrootdns.com dnsserver NS childdnsserver.myrootdns.com

Create Host AAAA record using dnscmd

2009-02-14T02:52:00.000-08:00

The following shows on how to add Type AAAA resource record to a dns through command prompt.

1. Assume the domain name is "myrootdns.com", dns server is "dnsserver", Host name of the machine for which to add AAAA record is "dnsserver" and IPv6 address of dnsserver is "fe80::212:79ff:fedb:e69"/

dnscmd dnsserver /recordadd myrootdns.com dnsserver.myrootdns.com /Aging /OpenAcl AAAA fe80::212:79ff:fedb:e69

To set timeout(20 secs) for AAAA record, run

dnscmd dnsserver /recordadd myrootdns.com dnsserver.myrootdns.com /Aging /OpenAcl 20 AAAA fe80::212:79ff:fedb:e69

Create Host Type A record using dnscmd

2009-02-14T02:17:00.000-08:00

The following illustrates on how to add Type A resource records on command prompt using dnscmd.

1. Assume the domain name is "myrootdns.com", dns server is "dnsserver", client Machine for which to add Host A record is "dnsclient.myrootdns.com" and IP address of dnsclient.myrootdns.com is "192.168.1.200".
2. Run below command to add Type A record to "dnsserver"

dnscmd dnsserver myrootdns.com dnsclient.myrootdns.com /Aging /OpenAcl A 192.168.1.200

3. To verify the record is created, run

dnscmd dnsserver /EnumRecords myrootdns.com dnsclient.myrootdns.com

To set timeout for the record, run

dnscmd dnsserver myrootdns.com dnsclient.myrootdns.com /Aging /OpenAcl 20 A 192.168.1.200

ZoneresetScavengeservers using dnscmd

2009-02-13T23:59:00.000-08:00

To set Scavenging servers for a zone on command prompt, do the following
1. Assume the dns server is "dnsserver" and zone is "myrootdns.com" and scavenging server ip address is 192.168.1.100.
dnscmd dnsserver /zoneresetscavengeservers myrootdns.com 192.168.1.100

ZoneResetSecondaries using dnscmd

2009-02-13T21:57:00.000-08:00

To set secondary server ip addresses with zone transfer options, do the following.
1. Assume the dns server is "dnsserver", zone name is "myrootdns.com" seconday server ip address is "192.168.1.200"

2. To allow zone transfered to only to the list of secondary servers, run
dnscmd dnsserver /zoneresetsecondaries myrootdns.com /securelist 192.168.1.200.

3. To allow zone trasfers to all secondaries, run

dnscmd dnsserver /zoneresetsecondaries myrootdns.com /nonsecure

4. To disallow zone transgers to secondaries, run

dnscmd dnsserver /zoneresetsecondaries /noxfr

5. To notify secondaries about the change in secondary settings, run

dnscmd dnsserver /zoneresetsecondaries /noxfr /notify

6. To disllow notifieing, run

dnscmd dnsserver /zoneresetsecondaries /noxfr /nonotify

7. To allow notify only to the list of ip addresses, run

dnscmd dnsserver /zoneresetsecondaries /noxfr /notifylist 192.168.1.200

Change zone type using dnscmd

2009-02-13T21:15:00.000-08:00

To reset a zone type on command prompt, do the following

1. Assume the server name is dnsserver and zone name is myrootdns.com.

2. To reset zone from ds type to primary, run

dnscmd dnsserver /zoneresettype myrootdns.com /primary /file myrootdns.dns

3. To change type from primary to ds, run

dnscmd dnsserver /zoneresettype myrootdns.com /ds

Display All records in a zone using dnscmd

2009-02-13T20:48:00.000-08:00

To print all the resource records in a zone on command promt, do the following
1. Assume the dns server is "dnsserver" and dns zone is "myrootdns.com".

zonewriteback using dnscmd

2009-02-13T20:39:00.000-08:00

To write back a zone to file on command prompt, do the following

1. Assume the dns server name is "dnsserver", zone which is to be written back is "
"myrootdns.com".

dnscmd dnsserver /zonewriteback myrootdns.com

Set ZoneUpdateFromDs using dnscmd

2009-02-13T09:19:00.000-08:00

The following shows on how to update zone from DS on command prompt

1. Assume the dns server is "dnsserver", and zone name is "myrootdns.com".

2. Run the below command to update zone

dnscmd dnsserver /zoneupdatefromds myrootdns.com

zone wirteback using dnscmd

2009-02-13T06:28:00.000-08:00

To write a zone to file or database through command line, do the following
1. Assume the dns server is "dnsserver", zone which is to be written back to file is "myrootdns.com"

dnscmd dnsserver /zonewriteback myrootdns.com

NodeDelete using dnscmd

2009-02-13T06:03:00.000-08:00

To remove all resource records from a host on command line using dnscmd, do the following.

1. Assume the dns server is "dnsserver", zone name is "myrootdns.com" and node name is "subdnsserver".

run the following to delete all resource records
dnscmd dnsserver /nodedelete myrootdns.com subdnsserver.myrootdns.com /f

2. If the node to be delete is "subdomain", then the entire tree of records to be deleted

dnscmd dnsserver /nodedelete myrootdns.com subdnsserver.myrootdns.com /tree /f

Set resetforwarders using dnscmd

2009-02-13T04:59:00.000-08:00

To add IP addresses to a dns server as forearders, do the following.
1. Assume the dns server to which to add forwarders is "dnsserver", forwarder ip address is 192.168.1.100
2. Run the command below to reset forwarders
dnscmd dnsserver /resetforwarders 192.168.1.100

To Set the timeout period (say 20 secs) the DNS server waits for a response from the forwarder, run

dnscmd dnsserver /resetforwarders 192.168.1.100 /Timeout 20
Also to prevent the DNS server from performing its own iterative queries if the forwarder fails to resolve a query, run
dnscmd dnsserver /resetforwarders 192.168.1.100 /slave
To allow iterative queries, run
dnscmd dnsserver /resetforwarders 192.168.1.100 /noslave

set resetlistenaddresses using dnscmd

2009-02-13T04:39:00.000-08:00

To add an IP address on the DNS server that listens for DNS clients through command line using dnscmd, do the following

1. Assume the dns server "dnsserver", IP address to be added is 192.168.1.100.

2. Run the following to reset listen addresses

dnscmd dnsserver /ResetListenaddresses 192.168.1.100

zone reload using dnscmd

2009-02-13T04:24:00.000-08:00

The following illustrates on how to update zone on command line using dnscmd command.

1. Assume the dns server name is "dnsserver", zone is "mydomainzone.com"
dnscmd dnsserver /zonereload mydomainzone.com

Note: If the zone is Active Directory-integrated, then the zone will be loaded from active directory. If the zone is a created from file, then the operation reloads from a file.

zone refresh using dnscmd command

2009-02-13T04:02:00.000-08:00

The zonerefresh operation on a zone triggers checking version number in the primary(master) server's SOA record. If the version number on the primary server is higher than the secondary's version number, then a zone transfer operation will be initiated to update the secondary server.

To force zonefresh on a dnsserver through command line, do the following

1. Assume dns server "dnsserver" and zone name is "myrootdns.com".

dnscmd dnsserver /zonerefresh myrootdns.com

Export Zone to a file using dnscmd

2009-02-13T03:24:00.000-08:00

To save zone configuaration in to a file through command prompt using dnscmd command, do the following.

1. Assume the dns server name is "dnsserver", zone which is to be exported is "mydomainzone.com"

dnscmd dnsserver /zoneexport mydomainzone.com mydomainzone.txt

The exported zone file can be located at %windir%\system32\dns.

Relevant Posts:
Export Reverse Lookup zone on command prompt

Resume dns zone using dnscmd

2009-02-13T02:55:00.000-08:00

To restart a dns zone on command line using dnscmd.exe, do the following

1. Assume the dns server is "dnsserver", zone which is to be resumed is "mydomainzone.com".

2. run the below command to start the stopped dns zone.

dnscmd dnsserver /zoneresume mydomainzone.com

Pause dns zone using dnscmd

2009-02-13T02:50:00.000-08:00

The following illustrates on how to suspend a dns zone temporarly on command line,
1. Assume the dns server is "dnsserver", dns zone name is "mydomainzone.com".
2. Now run the command below to stop working of dns zone temparorily
dnscmd dnsserver /zonepause mydomainzone.com

Relevant Posts:
Resume Dns Zone

delete dns zone using dnscmd command

2009-02-13T02:24:00.000-08:00

To remove a dns zone on command line, do the following
1. Assume the dns server on which to remove the zone is "dnsserver", zone to be deleted is "mydomainzone.com" .
2. Now run the below command to remove the zone.
dnscmd dnsserver /zonedelete mydomainzone.com /f

3. To remove DS integrated zone, run
dnscmd /dnsserver /zonedelete mydomainzone.com /dsdel /f

Delete Dns zone

2009-02-13T02:14:00.000-08:00

The following illustrates on how to remove forward lookup dns zone,
1. Assume the dns zone is "mydomainzone.com".
2. Open DNS snap-in manager using the command dnsmgmt.msc.
3. In the dns manager console tree, browse to the zone node "mydomainzone.com" , right click on the zone and click delete.

4. for removing reverse lookup zone(assume reverse lookup zone is 1.168.192.in-addr follow the same procedure
Relevant Posts:
Delete Dns Zone using dnscmd command

Install dns server through command prompt

2009-02-12T06:24:00.000-08:00

The following shows on installing dns server on command line using sysocmgr command. sysocmgr.exe is used to install windows optional components using unattended file.

1. Create a unattended file unattend.txt with the following content

[NetOptionalcomponents]
DNS=1

2. Now run the command below to install dns server automatically.

sysocmgr.exe /i:sysoc.inf /u:"unattend.txt" /f

3. To install it silently i.e without UI, run
sysocmgr /i:sysoc.inf /u:"unattend.txt" /f /q

4. Also to install it on multi-language environment, run

sysocmgr /i:sysoc.inf /u:"unattend.txt" /f /q /i

Install DNS Server

2009-02-12T05:34:00.000-08:00

The following illustrates on how to install a stand alone dns server,
1. Open add/remove program's Windows Component add/remove dialog using the command control appwiz.cpl,,2

2. double Click on "Network services" in windows components wizard.

3. In the Network Services dialog, select "Domain Name System (DNS)" and click OK.

4. Now click next in Windows Components wizard, Thus starts configuring dns server.

5. To verify the system successfully installed dns, check the dns server is running in servives wizard (services.msc).

Relevant Posts:

Install dns server automatically through command line

view dns zone information using dnscmd

2009-02-11T07:54:00.000-08:00

To find complete information of a dns zone, do the following

1. Assume the dns server name is "dnsserver", dns zone name is myrootdns.com.

2. Now, Run the following command to know the info of "myrootdns.com"

dnscmd.exe dnsserver /zoneinfo myrootdns.com

Note: To perform this operation, one must be a member of the Administrators group on the dnsserver or one must have been delegated the appropriate authority.

UnEnlist Directory Partitions using dnscmd

2009-02-08T08:50:00.000-08:00

The following illustrated unenlisting Directory Partitions on command line using the command dnscmd.
1. Asssume the dns server is "dnsserver", Directory Partition to be unlisted is "ExamplePartition.Myrootdns.com"

2. To unenlist partition, run

dnscmd dnserver /UnEnlistDirectoryPartition ExamplePartition.Myrootdns.com

Enlist directory partition using dnscmd

2009-02-08T08:01:00.000-08:00

To add dns server to Directory Partition on command line, do the following

1. Assume the dns server name is "dnsserver", Name of the directory partition to which the dns server to be added is "ExamplePartition.myrootdns.com".

2. Now run the command
dnscmd dnsserver /EnlistDirectoryPartition ExamplePartition.myrootdns.com

Create BuiltIn Directory Partitions using dnscmd command

2009-02-08T06:11:00.000-08:00

The following illustrates adding BuiltIn Dictory Paritions on command line using the command dnscmd.exe.

1. Assume the dns server on which to create builin directory partitions to be created is "dnsserver".

2. To create Directory Partition at domain level, run

dnscmd dnsserver /CreateBuiltDirectoryPartitions /Domain

3. To create Directory Partition for forest, run

dnscmd dnsserver /CreateBuiltDirectoryPartitions /Forest

Note: Here "dnsserver" should be forest dns server.

4. Finally, to add directory partitions to all domains, run

dnscmd dnsserver /CreateBuiltDirectoryPartitions /AllDomains

Directory partition Information

2009-02-08T05:28:00.001-08:00

A Directory Partition contain information above root dns, zone count, replica count resource records and so on.

To know information of a specific directory partition, do the following

1. Assume the dns server is "dnsserver", domain zone is "myrootdns.com", Directory Partition created at "dnsserver" is "DomainDnsZones.myrootdns.com"

2. To know info of the DomainDnsZones.myrootdns.com, run

dnscmd dnsserver /DirectoryPartitionInfo DomainDnsZones.myrootdns.com

3. To know Directory info in full detail, run

dnscmd dnsserver /DirectoryPartitionInfo DomainDnsZones.myrootdns.com /detail

Remove Application Directory Partition using dnscmd

2009-02-08T03:50:00.000-08:00

To remove a ApplicationDirectoryPartion say "ExamplePartition.myrootdns.com" using dnscmd.exe command, do the following

1. Verify the directory partion ExamplePartition.myrootdns.com

It can also be verified by running the following command

dnscmd /EnumDirectoryPartitions

2. Now run the following to delete the directory partition

dnscmd /DeleteDirectoryPartition ExamplePartition.myrootdns.com

Create builtin directory partitions

2009-02-07T22:40:00.000-08:00

By Default, when the DNS is installed, a application directory partition is automatically created at the forest and domain levels. If these didn't created while installing DNS, the dns manager console can be used to create builtin active directory partitions.
The following illustrates creating builtin directory partitions in dns manager console.

1. Assume the dnsserver name is "dnsserver".
2. Open DnsManager using the command dnsmgmt.msc.
3. In the dns manager console tree, right click on dns server node "dnsserver" and select "CreateDefaultApplicationDirectoryPartitions" option.

AgeAllRecords Fails with DNS_ERROR_INVALID_ZONE_OPERATION

2009-02-07T22:18:00.000-08:00

The dnscmd /AgeAllRecords command Fails with DNS_ERROR_INVALID _ZONE_OPERATION due to the following reasons.

1. Check the dns zone for which Aging/Scavenging feature is enabled as shown below (Assume the dns zone is "myrootdns.com")

2. Check the Aging/Scavenging feature is enabled on root dns zone as shown below(Assume root dns server name is "dnsserver".