Some clients not updating DNS records

[sidewinder]

We've been having an issue for a while now where clients are not updating their DNS records, despite automatic updates in DHCP being turned on. The first I hear of it usually is people moaning they can't get on Youtube, since the filter doesn't know what the computer is and thus who is logged in.

 

It does appear to be the same clients again and again with the problem, but then they could just be the people trying to get on things only available on the staff web filter policy.

 

The error logged when affected clients try to register is:

 

Log Name:      System
Source:        Microsoft-Windows-DNS-Client
Date:          29/10/2015 06:18:10
Event ID:      8015
Task Category: (1028)
Level:         Warning
Keywords:      
User:          NETWORK SERVICE
Computer:      PCNAME.domain.local
Description:
The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:

          Adapter Name : {C6686549-6C7F-4BEB-8F08-7000EF5C10D1}
          Host Name : PCNAME
          Primary Domain Suffix : domain.local
          DNS server list :
            	192.168.10.2
          Sent update to server : >
          IP Address(es) :
            192.168.21.2

The reason the system could not register these RRs was because the update request it sent to the DNS server timed out. The most likely cause of this is that the DNS server authoritative for the name it was attempting to register or update is not running at this time.

You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator.

 

Now the DNS server is most definately running, and this is happening at all of our 3 sites, all of which have their own DNS server. And if I do a manual ipconfig/registerdns it works, every time. Until the lease expires that is...

 

Pictures attached of DHCP and DNS Dynamic updates setup - this should be correct, I've always done it like this.

 

Any ideas?

 

Edited January 29, 2016 by sidewinder

[mikkydoos]

Scavenging set up ?

[mikkydoos]

Also...

 

DHCP--->DNS Tab ----- Option 2 radio button: - 'Always dynamically update DNS A and PTR records'

 

 

I set mine to Option 1. Not sure if your setting might be replicating or deleting records that don't need to be.

 

Same tab: Bottom tickbox - try unticking that too.

 

 

Those two settings look to me like they might be conflicting each other.

 

My settings (working fine)

 

Check that DHCP server 2 isn't conflicting also (If you're using one that is)

 

Edited January 29, 2016 by mikkydoos

[sidewinder]

Scavenging is set to 7 days.

 

One thing I'm not sure is correct is 'Discard A and PTR records when lease is deleted' - could this be adding to problems? Considering most clients are likely to receive the same address when they renew?

[mikkydoos]

Y thats what I said. You're relying on the client to update the record, not the DHCP server. I'd leave it all to DHCP.

 

If the machine is off or network is out when the lease time expires, it won't update. Another client might grab the IP and then you're left with a conflicting or duplicate A record, obviously rectified when you ipconfig /registerdns

[sidewinder]

Sorry replied before I saw your edit

 

OK will give that a go, thanks

 

Oh, and no conflicts or duplication - the records get totally deleted, and not from scavenging. Often I'll ping a machine and no A record can be found at all.

Edited January 29, 2016 by sidewinder

[sidewinder]

Sadly the issue is still present. Every single day this week I've had calls saying youtube isn't working on the theatre computer.

 

And every time there is no DNS record. But I've done a manual ipconfig/registerdns 2 days in a row, where is the record going? It's not long enough for the lease to expire (if it's renewed on bootup why does it dissapear?) and certainly not long enough to be scavenged.

 

Just to make it more confusing, on this particular PC, there is absolutely no error logged from the DNS client like I posted in the original post.

 

It's driving me insane

[mikkydoos]

Firstly try a full dcdiag on your DC and see if any errors are reported.

 

Also dcdiag /testdns

[sidewinder]

Done both and all passed except for failing the systemlog portion of the standard dcdiag due to it by the looks of it trying to communicate with a Google DNS server we have as a forwarder. The DNS test itself all passed though

[mikkydoos]

Have you got 2 DC's? Sounds like a replication problem between two to me.

 

EDIT:

 

Scratch that. Just re-read your first post.

 

Whats the link between the sites?

 

Any DNS info in ipconfig

Edited February 4, 2016 by mikkydoos

[sidewinder]

Yes 2 DCs at this main site and one each at other sites connected with 100Mb links.

 

dcdiag replication tests and repadmin show no errors though

[mikkydoos]

Yes 2 DCs at this main site and one each at other sites connected with 100Mb links.

 

dcdiag replication tests and repadmin show no errors though

 

 

What are the links? Same multiple buildings on the same premisies or 3 completely different geographical sites?

 

- - - Updated - - -

 

Try this too....

 

dcdiag /test:replications

[sidewinder]

Yeah did that and it passed

 

3 different geographical sites connected with leased lines

 

But the problem happens even just on the main site

 

Also this setup has been in place for well over a year, only the last few months have there been problems

Edited February 4, 2016 by sidewinder

[sidewinder]

I have had replication problems with sysvol between geographical sites which I haven't yet got to the bottom of, whether related I don't know

[mikkydoos]

Sounds like they can't connect to the DNS server. What are your DC's pointing to. Might be worth a look.

 

Someone posted a similar problem a while back and he had his DC pointing to ::1 that stopped it replicating.

 

Double check your DNS settings in DHCP.

 

I had a problem with some new machines I put in where they wouldn't pick up GPO's because of a DNS error.

Turned out that one of the DC's A records had disappeared or got scavenged.

 

One of the A records that begins with (Same as parent folder). Caused all sorts of confusion.

[sidewinder]

DC1 - IP - 192.168.1.2, DNS 192.168.1.2 & 127.0.0.1

DC2 - IP - 192.168.1.3, DNS 192.168.1.3 - the network is detected as public on this one, need to look into that

DC3 (2nd site) - IP - 192.168.5.5, DNS 192.168.5.5 & 192.168.1.2

DC4 (3rd Site) - IP - 192.168.10.2, DNS 127.0.0.1

 

IPv6 is switched off on all of them except DC4

 

All the Name Server and (same as parent foldr) A records are present on each DNS server

Edited February 5, 2016 by sidewinder

[mikkydoos]

That doesn't look right to me.

 

Microsoft say point DNS servers to their 2nd DC counterpart, so... in your main site, I'd maybe do it like this - where you've got your Preferred and Alternate DNS addresses in TCPIPv4 properties....

 

DC1:

P: 192.168.1.3

A: 192.168.1.2

 

DC2:

P: 192.168.1.2

A: 192.168.1.3

 

DC3:

P:192.168.1.2

A: 192.168.5.5

 

DC4:

P:192.168.1.2

A:192.168.10.2

 

 

....Assuming 192.168.1.2 is your FSMO role holder and the primary authoritative DC for your domain.

 

 

 

 

 

Are 192.168.5.xxx and 192.168.10.xxx in the same subnet ?

 

Whats the subnet mask Length ? e.g 192.168.1.1 /22

 

 

DC2 probably has the firewall on or something if its marked as Public - that might cause replication problems I would imagine.

 

 

EDIT:

 

Oh and check you have all of your DNS server addresses in your DHCP scope options.

 

How many DHCP servers have you got?

Edited February 5, 2016 by mikkydoos

[sidewinder]

I thought DNS servers were supposed to point to themselves first? That's how I've always had it setup.

 

192.168.1.2 is the FSMO holder yes. It's also the only DHCP server for all sites. Each sites scope has just the DNS server for that site (or both for the main site)

 

192.168.5.x and 192.168.10.x are different subnets. All are /24.

 

I should probably mention as well that although I built this network from scratch, I went away for 18 months and then came back, so it's sometimes tough to remember what was setup before I left and what was changed while I was away

[mikkydoos]

Take a look here...

 

windows - What should the order of DNS servers be for an AD Domain Controller and Why? - Server Fault

 

 

I'm thinking that your DNS servers aren't replicating so each is keeping it's own copy.

 

Do all your DNS servers show reverse lookup zones on DC1?

 

DNS should do this by itself.

 

This might help...

 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/7f06e326-4499-4e76-9387-69ba35d3e7df/dns-with-multiple-subnets

[sidewinder]

Thanks, am reconfiguring now, hopefully will help. Appreciate all the time you've spent on this!

 

Not sure what you mean about the reverse lookup zones, all of the servers have all of the reverse lookup zones, is that not right?

[mikkydoos]

Thanks, am reconfiguring now, hopefully will help. Appreciate all the time you've spent on this!

 

Not sure what you mean about the reverse lookup zones, all of the servers have all of the reverse lookup zones, is that not right?

 

On DC1 & DC2 there should be a reverse lookup for each zone in each subnet.

[sidewinder]

Just realised when looking through my posts that I never replied to this. All your suggestions worked and I haven't had a single problem with clients not updating records since this. Thanks

[mikkydoos]

Just realised when looking through my posts that I never replied to this. All your suggestions worked and I haven't had a single problem with clients not updating records since this. Thanks

 

Good news. Glad to help

[sidewinder]

OK this is still happening and it is driving me insane. 90% of clients register perfectly, but some STILL refuse. The DNS record completely disappears for these clients unless I do a manual update. ALL of our DNS servers have the correct IPs configured so they point at different servers, it isn't that anymore.

 

I really have had enough of this now, it's just ridiculous.

[mikkydoos]

@sidewinder Man!

 

I'd first check whether you have scavenging set up. That might be misconfigured.

 

Right click and properties your zone on all DC's. I would only set up scavenging on your primary DC. The rest can update from that.