Help needed - new 2003 AD DC in a *nix environment

[thom]

Hi everyone,

First a bit of background

• I have just taken over management of a network that has an SME (E-Smith) box as it's DC.
  
• This is failing and they bought a Windows 2003 box to replace it.
  
• I have set up loads of AD domains before but this site already has a DNS (8.4.6-REL-NOESW) & DHCP Server set up on a debian based router.
  
• They are connected to a middle school (On the same site) via another router and they have an existing SME DC that is working fine
  

My question is what should I do to get the Active Directory using the existing DNS service? Is it possible or do I need to set up a new DNS server on the AD box and just configure them to talk to eachother?

I am a complet nix newbie so please be gentle

[Diello]

Technically, yes, you can configure AD to use BIND for it's DNS queries - however, I wouldn't recommend it.

 

Using DNS in AD Integrated mode will be much better for you really - easier to manage, less error prone, and gives you the benefit of multi-master. Use DNS on your W2k3 box to manage your local domain, then setup the Debian box as a forwarder maybe? Might also want to look at upgrading BIND to v9.

 

Take a look here: http://www.microsoft.com/technet/archive/interopmigration/linux/mvc/cfgbind.mspx?mfr=true

[Geoff]

I presume the DNS is ISC BIND and the DHCP is ISC DHCPD then?

 

You need to make sure that either DHCP updates DNS when it issues a lease or that the Windows clients have sufficient access to be able to push DNS updates to the DNS server themselves.

 

You also either need to delegate the AD subzones '_tcp', '_udp', '_msdcs' and '_sites' in DNS to the DNS server running on the W2k3 DC.

 

Alternatively you can create your own static records and put them in your existing DNS server configuration. Your existing DNS server must support SRV records for this to function.

 

More info on technet here:

 

Microsoft Corporation

Microsoft Corporation

 

Using DNS in AD Integrated mode will be much better for you really - easier to manage, less error prone, and gives you the benefit of multi-master.

 

You get all this with BIND, and more. Try to migrate away will just add to the OPs headaches.

[Diello]

You get all this with BIND, and more. Try to migrate away will just add to the OPs headaches.

 

On BIND8?! Didn't even think BIND9 bin multi-master copies of the DNS zone?

 

Darn you and your Google-Brain

[Geoff]

Sure it does. Here's an example, with 3 masters. One using a non-default port and one using IPv6..

 

zone "example.com" in {
   type slave;
   file "slave.example.com";
   masters {192.168.2.7; 10.2.3.15 port 1127; 2001:db8:0:1::15};
};

[Diello]

Interesting, thanks - Nice to learn something new!

[thom]

Thanks guys, a couple of things,

I presume the DNS is ISC BIND and the DHCP is ISC DHCPD then?

You are correct Geoff.

I set up a virtual machine of 2003 svr to do some testing and it got me wondering about what order to do stuff in.

I set up AD with dns integrated and setup the router as a forwarder. That seemed to work OK.

Do i still need to do what Geoff says and why?

You also either need to delegate the AD subzones '_tcp', '_udp', '_msdcs' and '_sites' in DNS to the DNS server running on the W2k3 DC.

The current dns zone on the router is "site1.contoso.co.uk"

I wanted the new lan to be called "contoso.lan"

Is that possible or will it need to be something like "new.site1.contoso.co.uk" or "new.contoso.co.uk"

[Geoff]

What you have done will work, however it's messy and not really the 'correct' way to do it.

 

If you want to do it the 'right' way, perform a domain DNS rename using the domain rename tool, then proceed to follow whichever one of my solutions you feel like.

[thom]

Sorry Geoff but I am a bit confused

The new Server is currently part of the existing SME domain and hasn't been elveated to DC yet. I want to do it the "right" way so I am keen to follow your instructions. Is this the right order?

1, Update DHCP to v9

2, Add "aac.lan" as a zone on the DNS server config file

3, Run dcpromo on 2003 server

3a, Choose DC for new domain

3b, Choose "domain in new forest"

3c, Full DNS name = contoso.lan

3d, DNS Registration Diagnostics - install DNS later

I have just done this on my test server (except the bind update/configuration)

Am I on the right track? What's next?

I am just going to treat myself to a lunch break while that is updating :-)