DNS record ownership and the DnsUpdateProxy group

Question

I have a 2 x 2003 domain controller that have DNS and DHCP Services installed
I was thinking of configuring DHCP to use a service account to update DNS records.
If I set this, do the DHCP Servers need to be members of the DNSUpdateProxy security group for the service account to work?>

Answer 1

I have to agree with John here. I don't think it's reasonable to just say 'ms told us so'. We need a
technical before and answer is given. I have multiple DHCP servers and I use a security account on them to register the records and never use the
DNSUpdateProxy Group and I have no problems. My thinking is this:
Assume we are using Integrated Secure Zones in AD:
Scenario 1:
Windows DHCP server i registering records on behalf of clients
Not a member of DNSUpdateProxy Group and not using dedicated account
Records will have owner as dhcpserver$  and only that account can update
This is a problem if that DHCP server fails
Also, non Windows DHCP server with no AD account cannot update
Scenario 2:
Windows DHCP server i registering records on behalf of clients
Member of DNSUpdateProxy Group and not using dedicated account
Records will have owner as SYSTEM  and authenticated users can updated meaning any user or client on that domain
No problem if that DHCP server fails as any other authorized DHCP server can update
Non Windows DHCP servers can updated if they have a domain machine account
Scenario 3:
Windows DHCP server i registering records on behalf of clients
Using a dedicated account
Records added with owner same as this dedicated account
Another DHCP server that also uses this same account can updated the records
A non windows DHCP server that can use this account can also update the records
Now, can someone from MS please clarify the technical reason they say that in Scenario 3, you must add the DHCP servers to the
DNSUpdateProxy group ?
http://technet.microsoft.com/en-us/library/cc780538(v=ws.10).aspx
I guess this link didn't help?
DNS Record Ownership and the DnsUpdateProxy Group
"... to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates
with the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account."
http://technet.microsoft.com/en-us/library/dd334715(WS.10).aspx
Just to add:
Why is the DnsUpdateProxy group needed in conjunction with credentials?
The technical reason is twofold:
DnsUpdateProxy:
 Objects created by members of the DNSUpdateProxy group have no security; therefore, any authenticated user can take ownership of the objects.
DHCP Credentials:
 Forces ownership to the account used in the credentials, which the DnsUpdateProxy group allowed to take ownership other than the registering client.
Otherwise, the default process is outlined below, and this applies to non-Microsoft operating systems, too, but please note that non-Microsoft operating systems can't use Kerberos to authenticate to dynbamically update into a Secure Only zone, however
you can configure Windows DHCP to do that for you.
1. By default, Windows 2000 and newer statically configured machines will
register their own A record (hostname) and PTR (reverse entry) into DNS.
2. If set to DHCP, a Windows 2000, 2003 or XP machine, will request DHCP to allow
the machine itself to register its own A (forward entry) record, but DHCP will register its PTR
(reverse entry) record.
3. If Windows 2008/Vista, or newer, the DHCP server always registers and updates client information in DNS.
   Note: "This is a modified configuration supported for DHCP servers
         running Windows Server 2008 and DHCP clients. In this mode,
         the DHCP server always performs updates of the client's FQDN,
         leased IP address information, and both its host (A) and
         pointer (PTR) resource records, regardless of whether the
         client has requested to perform its own updates."
         Quoted from, and more info on this, see:
http://technet.microsoft.com/en-us/library/dd145315(v=WS.10).aspx
4. The entity that registers the record in DNS, owns the record.
   Note "With secure dynamic update, only the computers and users you specify
        in an ACL can create or modify dnsNode objects within the zone.
        By default, the ACL gives Create permission to all members of the
        Authenticated User group, the group of all authenticated computers
        and users in an Active Directory forest. This means that any
        authenticated user or computer can create a new object in the zone.
        Also by default, the creator owns the new object and is given full control of it."
        Quoted from, and more info on this:
http://technet.microsoft.com/en-us/library/cc961412.aspx
More on this discussed in:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/6f5b82cf-48df-495e-b628-6b1a9a0876ba/regular-domain-user-uses-rsat-to-create-dns-records?forum=winserverNIS
If that doesn't help, I highly suggest to contact Microsoft Support to get a definitive response. If you do, I would be highly curious what they say if it's any different than what I found out from the product group (mentioned earlier in this thread).
And of course, if you can update what you find out, it will surely benefit others reading this thread that have the same question!
Thank you!
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.