Correct DNS settings

[mrwoberts]

Forgive the double post, but the original location wasn't that sensible.

 

Folks

 

I've been Googling and I'm struggling to satisfy my mind that the setup is correct at a school I support.

 

Two physical servers.

Two domains - curriculum.internal (CS) and admin.school (AS)

 

This school only used to have one server, the AS server.

CS was introduced a few years back and has taken responsibility for DHCP, and DNS.

 

However, (AS) has the DNS role enabled and the NIC adapter settings are:

Primary 10.1.1.1 (IP of CS)

Secondary 127.0.0.1

 

The AS also has the CS zone in the forward lookup group, and vice-versa

 

The CS NIC adapter settings are

Primary 10.1.1.2 (IP of AS)

Secondary 127.0.0.1

 

Every workstation is given the following details for its DHCP request (served by CS)

Primary DNS 10.1.1.1 (IP of CS)

Secondary DNS 10.1.1.2 (IP of AS)

domain suffix curriculum.internal

 

Whilst things seem to be working, I want to make sure I'm following best practise.

 

Question time...

1. Is the DNS role strictly needed on the AS? If so, was is the correct way to configure it?
   
2. I've wondered whether I should be using conditional forwarders, or just include the others zone in the forward lookup
   
3. Any good resources, reading I could follow up with to get my head around good DNS and DHCP setup
   

 

 

 

Kind regards, hope you all have a good holiday

Edited March 31, 2017 by mrwoberts

[localzuk]

That is all a little confusing so I'm going to work through it.

 

You have 2 servers, each serving a separate domain?

 

Server AS hosting admin.school domain

Server CS hosting curriculum.internal domain

 

Each server has DNS set up.

 

Each server is using the other server as their primary DNS server.

 

One of the servers, CS, is hosting DHCP also.

 

So, for this to work effectively, I would say the following would need to be in place:

 

AS should have its own zone in DNS (admin.school), and should have the other in there too.

 

CS is the same but the opposite way round.

 

I would say having 2 DNS servers is a good thing (though I'd also say having 2 domains is out of date and unnecessary).

 

I would change each server to use 127.0.0.1 as primary, and the other server as secondary source for DNS.

 

With the zones on each server, I would have each server have the other domain's zone in as a secondary zone. No need for conditional forwarders etc...

 

Why do you have 2 domains?

[mrwoberts]

Thank you for the quick reply @localzuk. You've understood very well.

 

Why do you have 2 domains?

 

This is an historical thing that I've adopted, and is a fairly common (bad) occurrence in a number of schools I now look after. The more I think about it, the more I just want a single domain, but I just don't know how to go about that. Without asking too much of you, how would I go about merging into a single domain?

Ideally, I'd like to get rid of the admin.school domain since all it really does is have the office users (and GPs), and the SIMS database, which doesn't really need to be on a DC.

Even more ideally, I'd actually like the domain to be the name of the school, rather than 'admin.school', or 'curriculum.internal'

 

I certainly feel out of my depth with a number of server admin tasks such as this. Can you recommend any good reading? I have a couple of week spare :-)

[ReadTheNetwork]

I would probably go down the route of creating a trusted relationship between the two domains, this would then make it easy to transfer all the AD objects onto one domain (for example AS to CS). Ensure everything is working, then decommission the AS Domain Controller. Then go through and rename the domain. Exchange might struggle with this.

[djm968]

A good place to start.

 

https://technet.microsoft.com/en-us/library/cc974332(v=ws.10).aspx

[ReadTheNetwork]

Why do you have 2 domains?

This used to be quite common setup in schools (a curriculum domain and an academic domain).

@mrwoberts Just wondering how you got on with this task? Or if you need any further assistance?

[mrwoberts]

@mrwoberts Just wondering how you got on with this task? Or if you need any further assistance?

Thanks buddy. I've settled for the changes mentioned above and over the summer I'm starting from fresh with 2016 - bit drastic, but I'm just not confident in this setup and I wimped out of migrating DC objects over to the CS.

Do you have experience in this area?

[ReadTheNetwork]

Sometimes starting from fresh can be easier, I've not had to do this process itself but have moved from an RM system to vanilla. Which is a similar approach you're doing, starting from scratch and then transferring everything over.