DNS on Server 2008 R2: DNS A records strangely disappear

Question

Hello,
I am experiencing very strange problems with my DNS (Server 2008 R2, AD integrated). Several A records for Windows clients are missing, and even if I register them as static they somehow disappear again. However, the AAAA records are still around (IPv6 is
running in default configuration, I haven't touched that at all), but another strange thing here is, most of them are listed as STATIC records.
At present, the DHCP server is set to NOT register the clients with DNS. DNS accepts only secure updates, scavenging is disabled. (I am somewhat reluctant to disable dynamic updates on the DNS server completely because I think the DCs register and update
lots of records dynamically). When I register all missing A records, most affected clients loose it again within an hour or so but some seem be fine. It seems to me that about 20 % of the clients are affected.
I have enabled Directory Service Changes auditing, and its in fact the machine account which appears to be responsible. Clients with A records generate 10 entries (ID 5136) in the DC's security log while the problematic clients generate only the
first 5 events. So it appears to me that they can delete the record but not create a new one. All clients are set to register themselves with DNS.
As far as I remember I had Windows clients with missing A records in the past once in a while but the problem became really serious only about one and half weeks ago.
Does anyone have an idea of what might be going on here? Can I safely disable DNS dynamic updates without adversely affecting AD/DC functionality? Generally, we don't actually need dynamic updates.
Cheers, Georg.

Answer 1

What operating system are the clients?
I would like to first point out how registration works with static and DHCP, and the differences depending on how DHCP is configured.
=====================================================
1. By default, Windows 2000 and newer statically configured machines will
register their own A record (hostname) and PTR (reverse entry) into DNS.
2. If set to DHCP, a Windows 2000, 2003 or XP machine, will request DHCP to allow
the machine itself to register its own A (forward entry) record, but DHCP will register its PTR
(reverse entry) record.
3. If Windows 2008/Vista, or newer, the DHCP server always registers and updates client information in DNS.
   Note: "This is a modified configuration supported for DHCP servers
         running Windows Server 2008 and DHCP clients. In this mode,
         the DHCP server always performs updates of the client's FQDN,
         leased IP address information, and both its host (A) and
         pointer (PTR) resource records, regardless of whether the
         client has requested to perform its own updates."
         Quoted from, and more info on this, see:
http://technet.microsoft.com/en-us/library/dd145315(v=WS.10).aspx
4. The entity that registers the record in DNS, owns the record.
   Note "With secure dynamic update, only the computers and users you specify
        in an ACL can create or modify dnsNode objects within the zone.
        By default, the ACL gives Create permission to all members of the
        Authenticated User group, the group of all authenticated computers
        and users in an Active Directory forest. This means that any
        authenticated user or computer can create a new object in the zone.
        Also by default, the creator owns the new object and is given full control of it."
        Quoted from, and more info on this:
http://technet.microsoft.com/en-us/library/cc961412.aspx
=====================================================
Therefore, based on that, even if you have DHCP set to not register, and the clients are 2008/Vista and newer, then DHCP is doing it. That explains why you see the system account doing it.
Now, I think it will actually help you if you configure DHCP to register everything, configure credentials, and add the DHCP server computer object to the DnsUpdateProxy group. Don't add anything else to this group.
This way DHCP controls everything and it's easier to track AND more importantly, DHCP can update already registered records.
====================================================
In summary:
DHCP DNS Update summary:
- Configure DHCP Credentials.
  The credentials only need to be a plain-Jane, non-administrator, user account.
  But give it a really strong password.
- Set DHCP to update everything, whether the clients can or cannot.
- Set the zone for Secure & Unsecure Updates. Do not leave it Unsecure Only.
- Add the DHCP server(s) computer account to the Active Directory,  Built-In DnsUpdateProxy security group.
  Make sure ALL other non-DHCP servers are NOT in the DnsUpdateProxy group.
  For example, some folks believe that the DNS servers or other DCs not be
  running DHCP should be in it.
  They must be removed or it won't work.
  Make sure that NO user accounts are in that group, either.
  (I hope that's crystal clear - you would be surprised how many
  will respond asking if the DHCP credentials should be in this group.)
- On Windows 2008 R2 or newer, DISABLE Name Protection.
- If DHCP is co-located on a Windows 2008 R2, Windows 2012, Windows 2012 R2,
 or NEWER DC, you can and must secure the DnsUpdateProxy group by running
 the following command:
  dnscmd /config /OpenAclOnProxyUpdates 0
- Configure Scavenging on ONLY one DNS server. What it scavenges will replicate to others anyway.
- Set the scavenging NOREFRESH and REFRESH values combined to be equal or greater than the DHCP Lease length.
References:
This blog covers the following:
DHCP Service Configuration, Dynamic DNS Updates, Scavenging, Static Entries, Timestamps, DnsUpdateProxy Group, DHCP Credentials, prevent duplicate DNS records, DHCP has a "pen" icon, and more...
Published by Ace Fekay, MCT, MVP DS on Aug 20, 2009 at 10:36 AM  3758  2 
http://msmvps.com/blogs/acefekay/archive/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group.aspx  
Good summary
How Dynamic DNS behaves with multiple DHCP servers on the same Domain?
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/e9d13327-ee75-4622-a3c7-459554319a27
Another good Summary:
Thread: "DNS problem" December 18, 2013
http://social.technet.microsoft.com/Forums/windowsserver/en-US/37b8b6b3-6cb1-496c-8492-09ded13bab18/dns-problem?forum=winserverNIS
Another good discussion that Microsoft support concurred with my settings for a poster that called in to Support, which verified my configuration suggestions in my blog are correct:
DHCP Server Not Registering A Records for Windows Clients
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/e4b285d6-5795-4045-83ff-3a3c793b2cfc/
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.