DNS issues. HELP!

[Koldov]

Hi All,

 

I have been using a combination of things to remote in and shutdown computers manually and would like to streamline and automate this a bit.

 

However, trying both 'shutdown.exe' and 'PSshutdown' gives me 'network path' errors, although I can ping and connect through RDP. Last night using my old method it struck me that 'AngryIP scanner' rarely picks up the computer name. Then I saw one that is never left on (we'll call it PC2). When I connected to it with the IP address via RDP, the PC I actually connected to was in fact PC1...

 

Looing at the DNS record for that IP sure enough returned PC2 and not the actual computer that was using that IP address, PC1.

 

So I guess something is wrong with my DNS updating, but I really need some help as I don't know what to set or where.

 

1 x 2003 DC - DNS

1 x 2008 DC - DNS

 

As you can see from the picture, they have both been given the same IP, so maybe it is a fault with DHCP? This is NOT managed by the servers, but by the CISCO router...

 

 

Kol.

[pete]

Enable DNS scavenging and aging. You've got ten days between records there.

 

Specifically, read this: How DNS Scavenging and the DHCP Lease Duration Relate - Ask Premier Field Engineering - Site Home - TechNet Blogs

[Koldov]

I have set aging and scavenging, but I guess I'm not sure what are good intervals to set... I think I should set it aggresively, but then think what happens when nobody logs on for 6 weeks in the holidays, will all the records will be gone?

 

Do I set it on one server only? Which parts of DNS do I set it against, there appears to be a few? I don't know what the DHCP scope's refresh is set to, as it's on the router managed by another party.

 

I've read that post, and this one initially when I set it up:

 

Don't be afraid of DNS Scavenging. Just be patient. - Microsoft Enterprise Networking Team - Site Home - TechNet Blogs

 

Now I've re-read it a few times and it just doesn't make sense, after a while I might as well be reading Ancient Greek and as usual there are too many 'it depends' answers...

 

Unfortunately, I'm not really a 'read this and understand it' type, I need to do it. But, that could be a disaster!

 

Kol.

[tmcd35]

In terms of aging and scaveging, schools a pretty easy IMHO. They open for about 8 hours during the day, and then they're shut. So, 8 hours seems about right. Next morning all machines get fresh DHCP allocations for the day and DNS is updated with the new records.

[Koldov]

So where would I put this 8 hours..?

 

 

No Refrsh, Refresh or both?

 

Kol.

[tmcd35]

Just checked my settings. I have both set to 8 hours and the lease duration for DHCP clients (on the DHCP server) also set to 8 hours. Seems to work well here. As I say, gives a daily refresh of DHCP and DNS.

 

One of the reasons we do that here is because we don't have too many IP's available and don't want IP's to be tied up to a smartphone or tablet or something that has been taken off site or no other wise not in use today.

 

At the last place were IP's got particularly precious I had the time down to 4 hours, although that got tricky with timing because you want to make sure DHCP is updating DNS and stale records are properly scavenged.

[Koldov]

So the DHCP on the CISCO managed router should ensure that no host has a duplicated IP address, but DNS cannot obviously do the same?

 

It has recorded that host (1) has been allocated an IP address on day 1, then on day 2 DHCP gives that same IP address to a new host (2) who just so happens to boot first (DNS now records that the new host (2) has this IP, but will not delete the old old host record (1) with a duplicate IP until it is told it is stale and needs to be scavanged), or until host (1) boots up and the DNS record for it's IP has been updated.

 

Is that right, in theory?

 

Even if host (1) is turned on and given a new IP which DNS records can a host have two entries in DNS? It's bugging me as both computers were booted yesterday so there must have been a record for host (1) to have had the old IP but also (I hope) a record for it's new IP, as they both could not have been on the network with duplicate IP's...

 

That was a bit of a ramble sorry, still not making sense...

 

Kol.

[tmcd35]

I don't know about Cisco routers but Windows DHCP server has the option to update DNS whenever it leases or frees an IP. I have my DHCP server set to dynamically update DNS A and PTR records. If something slips through the net then the aging/scaveging should clear it out. The way ours is set on an 8 hour lease means machines get a new IP registered with DNS when they first turn on. 8hours later DNS can refresh the record and DHCP will delete if the client doesn't renew the lease. 8 hours later, before the start of a new school day, the scaveging should kick in and delete any stale records that DHCP hasn't removed (which it should do) when the lease is deleted. Everything starts a fresh the next day.

[Oaktech]

Perhaps i'm missing something... I wouldn't try to run windows DNS without windows DHCP... Seems like asking for trouble exactly like you've got.

 

Is setting up windows DHCP an option?

[Davit2005]

Be patient with the settings it may take a while to actually take effect.

 

I had the same issue here with upto 6 machines reporting the same IP Address. This can cause no end of problems as you are aware, issues with SCCM, AV management etc which can rely on the Machine name to resolve against the correct IP address.

 

As @Oaktech mentioned, you'd be better off putting DHCP on a Active Directory member server splitting the Zone for reliability which is a lot easier in 2008R2.

 

The mechanisms in modern AD also make it more secure against rogue DHCP servers creeping in.

Edited December 17, 2013 by Davit2005

[tparad]

Hi,

1. have you tried to rebuild the DNS zone? seems to fix some issues from time to time.

2. have you tried to re-configure the DHCP scope? there is an option with a command to export the settings so you won't miss anything when u re-configure.

 

sometimes when the server runs for some time, we go in and make changes which doesn't always effect right-on and are silent.

hope one of these or both, fix your issue for the long range.

please post back.

 

also one more thing, please review DNS errors in the Event viewer of the server and post back with -any- errors.

screen shots are most welcome - or a fixed issue

 

kobi

[Koldov]

Thanks all,

 

Well from a quick IPCONFIG it would appear my DHCP lease from the router is 24 hours.

 

 

Does anyone know what 'PREFERRED' means on the IPV4 ADDRESS? Maybe this is why some machines are clinging onto an IP?

 

Also the way I figure it, if I boot one morning at 08:30 and am given IP x.x.x.x that will not refresh until 08:31 the next day. If that next day I boot at 08:25 my IP lease has not expired and I will continue to use it the next day (unless DHCP has given it to someone else, which it shouldn't as it hasn't expired). If that computer is not booted until 08:32, DHCP may well have given out that IP address to another PC, but as DNS hasn't scavenged the old record it now holds two host records for the same IP.

 

Can someone sense check that for me please? I think I am slowly getting my head around it!

 

So theoretically I should be looking to scavenge every 24 'and a bit' hours as this is when DHCP has expired all its leases?

@tmcd35, what do you have for the 'SERVER' properties?

 

 

Also in that case, the 24 'and a bit' hours should go in the 'ZONE' properties (where your 8 hours is)? There is no point in me setting scavenging any earlier as DHCP would not have renewed leases.

 

 

We have about 8 VLANS here all configured through the 'managed' CISCO ROUTER/SWITCH solution. It was all set-up before I started here, but I have to say I am glad I haven't had to configure DHCP for that lot!

 

Kol.

[tparad]

Preferred is static ip.

 

i'd advise only 1 DHCP server on a network, i hope that's not causing the duplicate IPs.

with right configuration it is possible to run more ofcurse..

 

DHCP leases don't work that way, they re-check validation every half a time.

for ex:

if your lease time is 8 hours, the computer is the owner of the IP for the next 8 hours.

after 4 hours (half the time) the DHCP validate the computer. In case still online - renews the lease time to 8 hours.

means, if u obtain a new IP at 8 AM, and turns the computer off at 4:05 PM.

obtain: 8 AM

renew: 12pm

renew: 4 pm

lease time then will be 8 hours from 4 PM >> 12 AM.

/EDIT if the computer is offline the timer is keep counting and again half the time that is left - recheck.

lease 8 hours

recheck 4 hours - offline

recheck 2 hours - offline

recheck 1 hour - online > back to 8 hours.

recheck after 4 hours.

EDIT/

if it's 24 hours you can already see.

 

in other words, lease time should be 8 days.

depends on the network setup and usage, those are just defaults \ recommanded.

(DHCP>Scope>Right click - Options > under General)

 

You havn't check DNS error logs

Edited December 18, 2013 by tparad

[Koldov]

 

in other words, lease time should be 8 days. ???

 

@tparad

 

Thank you for your help and insight.

 

There are no errors in the DNS logs.

 

However as clearly stated in my first post, I have no control or view into configuration for DHCP on this network. It is set-up and configured through the 'managed' CISCO router/switch solution.

 

Also if DHCP indeed does check every half the time of lease (24 hours in my case) it would check in 12 hours? Hopefully finding the computer off (don't think any teachers work a 12 hour day in School) it should release the IP. If it is not renewed with the same IP in the morning hopefully my 24 hour DNS scavenge should delete the old record.

 

Kol.

Edited December 18, 2013 by Koldov

[tparad]

12 hours yes, but then 12 more left. (original time is 24 not 12)

so if the computer is offline for 24 hours that might be enough to delete it if savaging is timed to do so before the computer is online again.

 

also... u wanted to automate a task.

How to schedule computer to shut down at a certain time in the night. - Microsoft Community

How to Automatically Shut Down Your Computer at a Specified Time

i'm pretty sure you can have the user asked to click "not now" thingy so it won't shut down unless no respond for 60 seconds.