renaming the domain name

[dibekem]

Hi

We are having major issues with users unable to remote into their computers from outside of the school.I contacted our network provider who has pointed out that the school’s domain name is a real domain which ends with sch.uk. This is the reason users dropping out of sessions when they remote in. They said an internal domain should end with .local or something like that.Now, how easy is to rename the domain? The school is very small only about 12 computers and users. The server runs on Windows Server 2019 and it is the main server. Runs GPO, DC, AD, DHCP and file server.

Any help would be much appreciated.

Thanks!

[FishCustard]

Your network provider is wrong - best practice is that internal domains do not end with "made-up" TLDs like "local" or "internal", but are a subdomain of a domain you actually own (e.g. ad.school.whatever.sch.uk, or internal.school.whatever.blah).

 

Having the AD domain the same as your public domain can cause issues, but they can be worked around. What is your AD domain name?

[dibekem]

Thanks.

 

I would rather not mention the school but the AD domain name is the schoolname.boroughname.sch.uk.

 

So this could be changed to internal.schoolname.boroughname.sch.uk but don't know the step and also how risky is it?

 

Thanks

[robk]

Thanks.

 

I would rather not mention the school but the AD domain name is the schoolname.boroughname.sch.uk.

 

So this could be changed to internal.schoolname.boroughname.sch.uk but don't know the step and also how risky is it?

 

Thanks

Can you elaborate as to what the problems are?

 

Ours is the same internally and externally (which is not best practice now) but everything is working..

[Cw2k]

Thanks.

 

I would rather not mention the school but the AD domain name is the schoolname.boroughname.sch.uk.

 

So this could be changed to internal.schoolname.boroughname.sch.uk but don't know the step and also how risky is it?

 

Thanks

 

rendom is the command, not done it myself yet due to the other services we have that have extra work to get them working once rendom is done (adfs, O365)

 

All workstations have to be rebooted at least twice after the rendom to update the domain.

 

Sort out any pre existing ad, dns issues before you attempt it. Ensure all DC’s syncing correctly etc.

 

Test it in a lab environment, preferably a replica of your live systems.

 

If you have Exchange 2013 or below you will break it if you rendom and it is incredibly difficult to rebuild. Not sure about Exchange 2016+.

[free780]

As @FishCustard said this is Microsoft's recommendation.

 

https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx

[MatthewL]

Just going back to the main post, you state users are remote into their computers from home, how is this achieved by the end user?

[dibekem]

Thanks for the posts.

 

We are on LGFL so rav3 via the website and I have also tried Cisco Anyconnect VPN.

 

The rav3 drop the user out, the VPN one log the user in but not all of the data loaded. Although sometimes it does. I thought it was the profile so I redone the profile but after it was still not loading properly.

 

When I contacted LGFL they said roughly this

 

you are trying to access domain based resources outside of the network, but having the internal network resolvable in the real-world, so outside the VPN is a real domain. If I query it, it fails, which would give you the symptoms you are detailing. Using a real-world domain as an internal domain is considered bad practice and all domains should end with .internal or local, or even start with that so its considered the global domain of internal.domainname,

essentially DNS and resolution of names internally should never conflict with the outside world, in this instance it can do and would cause problems.

 

I think I just need to rename the domain and it would be fine. We have other school whose internal domain do end with .local and have no problems what so ever.

[Primus]

Nope nope nope - AD domains should not end in .internal or .local - MS have advised using a real domain that you own for many years now.

 

LGFL shouldn't be giving this advice at all.

 

It's a simple DNS issue - make sure your external DNS is configured correctly with whoever hosts it.

[PaddyNewman]

Just a reply to this as I feel it was me that dealt with your support case. We use AnyConnect with split-DNS configured. You provide your domain name to us (which would be your real work domain, you haven't got a subdomain of that) which is then configured in the VPN;

 

Example..

default-domain value school.borough.sch.uk

Would then have a rule to allow both direct LGfLDomain and SpecifiedDomain through the VPN.

split-dns value lgfl.org.uk school.borough.sch.uk

 

When your machine from home connects and you ping PCNAME1, it'll try and append those. If it decides to query your outbound DNS rather than going down the tunnel, it'll hit public DNS, get no resolution and not work. This is what was happening in your instance.

 

By all means, if we can get another case raised and we work together on it, we can narrow down what is happening. I'd suggest installing Wireshark, whilst it won't see into the VPN, it will see all other traffic, so you'll see a DNS request outbound to your local DNS. If that happens, the device isn't sending down the VPN. I'm happy to do this from home to replicate exactly what you have in place but I'll need some basic AD credentials to log in etc. if you want to go forward, ping me in a case and I'll assist as much as I can.

 

Thanks

Paddy - Atomwide.

[mavhc]

Renaming a domain is a drastic step that will break a lot of stuff, easier just to fix dns

[dibekem]

Thank you.

 

The school is on holiday so I might have to park this until September.

 

I will report back once I can work on this again.

[PaddyNewman]

Renaming a domain is a drastic step that will break a lot of stuff, easier just to fix dns

Hi there,

 

Genuinely interested to hear what DNS changes could be made to make this work, for my own knowledge if anything else!

 

Are you able to let me know what you would do in this situation as currently the school use their external domain internally and we use split-dns to tunnel this down the VPN. In this instance, it wasn't going down there and looking at public DNS. This would mean they would need to have private IPs in their public realm DNS and thats just not great.

[mavhc]

Question is why the vpn is using public dns? Can't it just use the LAN dns?

[PaddyNewman]

Question is why the vpn is using public dns? Can't it just use the LAN dns?

LAN DNS servers are provided down the VPN, problem being the computer is not always querying it down the VPN. A capture will show a query to the gateway for DNS and the record not found response.

It 'should' go down the VPN but it isn't. The VPN works fine for most customers, but the only ones I've ever had issues with using AnyConnect and Split-DNS are users that have real world domains internally, every one I've had to troubleshoot has had external DNS resolving an internal request.

 

To 'bodge fix' these, I usually just ask them to change their mapping batch to use an IP for home users, but in this instance I think its all group policy mappings rather than batches on logon.

 

By all means I am happy to listen to any solutions

[mavhc]

Not used anyconnect, but https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116016-technote-AnyConnect-00.html

[PaddyNewman]

We aren't on 4.2 currently, but its definitely worth giving a try if we can licence it, thanks!

[ITGURU]

.local or .internal doesn't really matter. I'm still running both types with exchange servers with no problems at all.

[JATSO]

Just seen this thread and hope someone can point me in the right direction.

I have setup our new Server 2019 installed Hyper V and a virtual server 2019 within HyperV

Our old Domain still running is called:

 

WXYZ.school.council.sch.uk

Current DC Server 2008 is called SERVER1

 

What should i call my new virtual server?

should I just call it SERVER2 and link it to the current domain WXYZ.school.council.sch.uk

 

Thanks

[Jcx500]

i Would Call it SCHOOL-DC01

[FishCustard]

Best to give servers descriptive names: "DC01", "FILE01", etc.

 

Whether you include the organisation name depends on your environment (e.g. are you part of a MAT with a single forest or domain trusts?) and personal preference.

[JATSO]

Best to give servers descriptive names: "DC01", "FILE01", etc.

 

Whether you include the organisation name depends on your environment (e.g. are you part of a MAT with a single forest or domain trusts?) and personal preference.

 

Thanks.

Just a primary school with its own forest and 1 current DC (2008) which will eventually be decommissioned and put to storage use as the onsite backup and images.

[mavhc]

XYDC01 XYDC02 XYFS01, keep them short, saves typing