New RODC and DNS Server

[ordeology]

Hi

 

We have a single forest domain which we will call contoso.local with two child domains which we will call abc.contoso.local and xyz.contoso.local we currently have two forest level DCs running DNS and two DCs running DNS per child domain. These domain controllers run Windows Server 2016 domain functional level 2016. We have taken on another school and need to throw in a server with RODC's for the child domains as they cannot afford to put in a decent WAN connection so we have to go over a 20mb internet line with IPSec. To carry out the initial install I have set up a VLAN at one of our current sites for the new RODC's to sit on so that when I'm ready to throw the server into the new site I can just throw it in with out any IP changes needed.

 

I'm using Windows Server 2016 to create the new RODC's, when creating either of the new child RODC's it does not allow me to install the DNS server part when going through the AD promo gui as it says "DNS cannot be installed on this domain controller because this domain does not host DNS". This happens on both abc and xyz.

 

I ran dcdiag as per this link https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/troubleshoot/verify-dns-functionality-to-support-directory-replication

and on both abc and xyz domains I get the following at the end just change abc1-dc to xyz1-dc below

 

The A host record(s) for this DC was found

The SOA record for the Active Directory zone was not found

Warning: The Active Directory zone on this DC/DNS server was not found (probably a misconfiguration)

Root zone on this DC/DNS server was not found

 

Summary of test results for DNS servers used by the above domain controllers:

DNS server: XXX.XXX.XXX.XXX (abc1-DC)

All tests passed on this DNS server

Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered

DNS server: XXX.XXX.XXX.XXX (abc2-DC)

All tests passed on this DNS server

Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered

Summary of DNS test results:

Auth Basc Forw Del Dyn RReg Ext

_________________________________________________________________

Domain: abc.contoso.local

abc1-dc PASS WARN n/a n/a n/a n/a n/a

......................... contoso.local passed test DNS

 

 

On the forest level I see this

The A host record(s) for this DC was found

The SOA record for the Active Directory zone was found

The Active Directory zone on this DC/DNS server was found primary

Root zone on this DC/DNS server was not found

 

Summary of test results for DNS servers used by the above domain controllers:

DNS server: XXX.XXX.XXX.XXX (forest2-dc)

All tests passed on this DNS server

Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered

DNS server: XXX.XXX.XXX.XXX (forest1-dc)

All tests passed on this DNS server

Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered

Summary of DNS test results:

Auth Basc Forw Del Dyn RReg Ext

_________________________________________________________________

Domain: contoso.local

forest1-DC PASS PASS n/a n/a n/a n/a n/a

......................... contoso.local passed test DNS

 

 

Any help would be great... I'm struggling a bit here even with scouring the internet for similar issues.

[ordeology]

Fixed it... https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816624(v=ws.10) needed to enlist the RODC's in to the partition and all works as it shoud.

[Guest Guest]

What's the reason for using RODCs as apposed to regular DCs? I was under the impression that they are to be used when you cant be sure that the physical server is secure. After a quick Google search it appears that they can increase load over a wan link