Msdsc folder and forward lookup zone

I have a customer running a 2012 domain. In DNS, there is a Forward Lookup Zone named _msdcs.domain.name and also a folder named _msdcs inside the domain.name
Forward Lookup Zone.
The folder is grayed out. From what I've read, this folder may be a leftover from a previous domain OS upgrade. Can it be deleted safely?
Also, we think there may be some corruption in the _msdcs.domain.name zone. From what I have read, it seems like we can delete it and Active Directory will re-create it. Do I have that correct?
Jonathan

The grayed out _msdcs folder is a delegation that should contain NS (Name Server) records for the DNS servers that hold the _msdcs.domain.ext zone - However it's only used in scenarios where the _msdcs.domain.ext zone isn't replicated or available at all
DCs - in a multi-domain environment for example.
No you should not delete the zone, it's needed for replication, if you wish to re-create it for a good reason, you have to point _all_ DCs to one single DNS Server where you re-create the zone.
But there is no need to do this unless in rare situations, if you think information is missing dcidiag /test:dns /E will find out.
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog
So if this is a single domain with 2 Windows 2012 DNS servers, it seems like I can delete that grayed out folder. Correct?
As for deleting and re-creating the zone, we believe there may be corruption in it and have read that if the zone is deleted, then AD will automatically re-create it.
Jonathan

Similar Messages

Setting Forward Lookup Zones in DNS based on the port queried

I have the following problem.
We are using Dynamic DNS to access our site and the modem/router differentiates via port forwarding what server the query goes to based on the port number ie all request go to abc.dyndns.org:port number.
Based on the port eg. port 3389 goes to server1 (192.168.0.1), port 8080 goes to server 2(192.168.0.2), port 80 goes to server 3 (192.168.0.3). This all works well if you are entering from OUTSIDE the local network.
INSIDE the local network, I have setup a Forward Lookup Zone on a Domain server using DNS where the Host A resolves abc.dyndns.org to the local IP address of server 1 (192.168.0.1). This works fine.
How do I get the abc.dyndns.org:other ports to go to the other servers IP addresses as you can only setup one Host A record of abc.dyndns.org to one address 192.168.0.1, if someone queries from INSIDE the local network as the modem/router does not
come into play?

As I said before, DNS doesn't do this. DNS has nothing to do with ports resolution. It's purely a name to IP or IP to name resolution. THAT'S IT!
But you can port translate each individual port from the WAN IP to different IPs internally. I thought I said that earlier? Maybe I wasn't clear. I apologize for not fully explaining it, for I thought you understood that part.
Revisiting the bottom of your original post:
INSIDE the local network, I have setup a Forward Lookup Zone on a Domain server using DNS where the Host A resolves abc.dyndns.org to the local IP address of server 1 (192.168.0.1). This works fine.
How do I get the abc.dyndns.org:other ports to go to the other servers IP addresses as you can only setup one Host A record of abc.dyndns.org to one address 192.168.0.1, if someone queries from INSIDE the local network as the modem/router does not
come into play?
You still have to specify the port internally. Assuming mail.domain.com is server4 (since you didn't specify that port in your original post), you simply create a mail.domain.com zone and give it a blank IP for (making this up) 192.168.0.3, then type in
the same exact thing you would do from the outside:
http://mail.domain.com:8083/folder
Like I said, it's in the application. DNS just resolve to an IP. There are 65,536 port numbers, and DNS does not deal with resolving any of them. That's the responsibility of the application or service and the client (such as a browser) connecting to
it.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

Create a "New Zone" in the "Forward Lookup Zone"

I am working I Windows Server 2008 R2 SP1.
I went to DNS Server and tried to create a "New Zone" in the "Forward Lookup Zone" under "subdomain.domain.com".
I got the error: "Zone Not Loaded by DNS Server".
Tried to F5 to Refresh but still same error.
How do I get a new child or "subdomain" that will work in forest or "domain.com"?

Hi
You need to create a new child Domain in a new server.
Build a new server and follow the belwo link as how to create a new child domain. This will create a subdomain as well a DNS
http://technet.microsoft.com/en-us/library/cc771856(v=ws.10).aspx

When trying to assign IP reservation in IPAM, Domain does not appear in Forward lookup zone drop-down list

I am trying to assign reserved IP Addresses through IPAM that is installed on a Server 2012 OS. Here is the procedure I have been following:
Login to IPAM server
Open Server Manager
In left-hand column select IPAM
In left-center column expand IP ADDRESS SPACE
Select IP Address Range Groups
Right-click the appropriate address range and select Find and Allocate Available IP Address
In new window, scroll down to Basic Configurations
I can input the basic configurations with no problem. DHCP Reservation Synchronizations look good too. But when I get down to DNS Record Synchronization, I can't do anything with the Forward lookup zones because nothing appears in the drop-down
lists and I cannot manually enter the zone name. Here is a screen shot of what I see at this point:
Without completing this information, I cannot complete the Address Reservation.
Any help or insight will be greatly appreciated.
Thanks!
Tom LaLumiere

Hi Tom,
This happens if your DNS servers that are managed by IPAM are not authoritative and primary for any zones, if they are not authoritative for the appropriate zones, or if there are not any DNS servers managed by IPAM.
See the examples below. Here my DNS server is authoritative for 4 forward zones and 2 reverse zones. I can choose any of the forward zones but assuming I pick a range such as 10.0.1.0, I would be unable to choose the 168.192.in-addr.arpa zone because the
IP addresses do not match.
-Greg

Delegate DNS Forward Lookup Zone

A: DNS - I would like to delegate the ability of creating Forward Lookup Zones at the root of my DNS (not subdomain).
For example, i would like to delegate to my "Tier 1" staff with the ability to modify our DNS. i want our "Tier 1" staff to have the ability to create a Primary Zone in order to redirect users that attempt to access a site with known malware content to an internal site with a warning message notifying the user that they have attempted to access a site that is not allowed.
Is this possible?

Hiya,
I'm about 86% sure that if they need permissions to create primary zones, they will have access to the complete DNS administration. So it's just a question if that is ok?
If that is okay you can add the users to the DNSadmin group and they should have access to perform the above from the DNS administration tool, which can be installed anywhere.

How to Install DNS ROLE and its FQDN service and Reverse Lookup zone in Server Core using Powershell?

Hi
I am Setting A Lab Scenario That the PC name "Core2012" i.e. Server Core 2012 Will be Domain Controller.
Using PowerShell I have done this Task
Change hostname ; Configure IP address and Preferred DNS address ; Disable IPv6 ;
Configure Firewall ; Even Active Directory Role install.
Now problem occur
Well I have know to install DNS role install-WindowsFeature DNS
Ok
But;
How to configure FQDN ; Restore mode password ; Setting up global catalog server ;and configure Reverse Lookup zone Using powershell
I have search many Forums but I am not getting to touch with it.
So I Need a help to set and Configure DNS using Powershell
Thank You!!!
sagarpdalvi

Hi Sagarpdalvi,
To set the Safe mode password with powershell, please refer to the cmdlet Install-ADDSDomainController, to enable global catalog(GC), please run the cmdlet "Set-ADObject" after install Active Directory on the core server, to configure Reverse Lookup zone,
please refer to the cmdlet
Add-DnsServerPrimaryZone.
To configure DC with powershell, please check the scripts:
Installing a Domain Controller on Windows Server 2012
R2 Core
Enabling and Disabling the Global Catalog
To configure DNS, the Domain Name System (DNS) Server Cmdlets should be helpful for you:
http://technet.microsoft.com/en-us/library/jj649850.aspx
I hope this helps.

What's the benefit of creating Forward Lookup Zones?

Once I install the DNS Server (using Windows Server 2008 R2).
Do I need to create a new Forward Zone? Why?
Believe you can do it, and you will!!

Hi Ralph,
Yes you do, otherwise you will not be able to query hostname to ip address, for instance say you have dev machine, the hostname is devmachine, if you try to rdp, ping...etc you will not be able to do so, it will throw an error, hostname not found
Regards

2 domain, each with 2 way transitive truts, with sub domains pointing to the same DNS server (how should forward and reserver look zone be configured)

Hello,
I found a test environment and I just trying to understand how it works.
If I have two domains (a.com and b.com) with sub domains(a1.com and b1.com) with two way trust and I want them to point to a Windows DNS server. How should the Forward lookup zones and Reverse lookup zones be configured? In forward lookup
zones do I just add a new zone, make them all primary since only one DNS server, add a.com and b.com and do the same for reverse zones.
Do the sub domains need to be added? What about pointers? Do I add the IP address of a.com and b.com in reverse lookup zones.
A side question: When you create a Domain with dns AD intergrated the forward and reserve lookup are automatically created. You don't need to add the zone of the domain you just created but have to add zones of other domains.

Hello,
I found a test environment and I just trying to understand how it works.
If I have two domains (a.com and b.com) with sub domains(a1.com and b1.com) with two way trust and I want them to point to a Windows DNS server. How should the Forward lookup zones and Reverse lookup zones be configured? In forward lookup
zones do I just add a new zone, make them all primary since only one DNS server, add a.com and b.com and do the same for reverse zones.
Do the sub domains need to be added? What about pointers? Do I add the IP address of a.com and b.com in reverse lookup zones.
A side question: When you create a Domain with dns AD intergrated the forward and reserve lookup are automatically created. You don't need to add the zone of the domain you just created but have to add zones of other domains.
Make each domain controller as a DNS server too. Reverse lookup zones & forwarders are not replicated automatically. You can create AD-Integrated reverse lookup zone & set the replication scope.
You can create AD-Integrated DNS zones in the parent/root domain, set the replication scope to the forest-wide & delegate the zones for handling request locally. Once you create AD-Integrated DNS zone & set the replication scope forest wide, all
the zones will appear automatically in each domain's DNS server.
http://awinish.wordpress.com/2011/04/09/configuring-dns-in-child-domain/
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

DNS: Forward Lookup Domain with Just the MX Record

Our Active Directory domain is olddomain.com. I have a Forward Lookup Zone for olddomain.com with CNAME, MX, and many A records. The MX record points to an internal mail server.
We just acquired newdomain.com.
newdomain.com is resolving to external DNS and it works. However, I need to route the internal mail flow of newdomain.com to our internal mail server and not have it pass out to the internet before coming back in.
I would like to add JUST the mx record for newdomain.com to DNS. All other lookups (newdomain.com, subdomains.newdomain.com, etc) should work exactly as they do now.
I have had two thoughts how to do this, but need advice:
Can I have all newdomain.com DNS lookups point to an external DNS, except for the one MX record?
Can I have all newdomain.com resolve to olddomain.com IPs (including subdomains), except for the newdomain.com MX?
I tried adding a new Forward Lookup Zone for newdomain.com with just the SOA, two NS, and the MX record. This broke resolution for http://newdomain.com and http://www.newdomain.com until I added two A records. I do not want to be manually adding records
for all of our newdomain.com subdomains.
What do you recommend?
Thank you in advance!

Can I have all newdomain.com DNS lookups point to an external DNS, except for the one MX record?
You cannot as you will face the problem you already described.
However, you might think about doing it that way:
Get a copy of your external DNS zone (If you can do it of course) using
NSlookup: http://social.technet.microsoft.com/wiki/contents/articles/29184.nslookup-for-beginners.aspx
Create a zone named newdomain.com
Develop a script that will create all the DNS records from the extracted copy except for the MX record
Can I have all newdomain.com resolve to olddomain.com IPs (including subdomains), except for the newdomain.com MX?
Same answer as before.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Permissions to create Reverse Lookup Zones in DNS

What Active Directory permissions are needed to create Reverse Lookup Zones in DNS? My co-worker is getting an access denied error when completing the wizard for this and the zone is NOT created. He is a member of the "DnsAdmins" group and
he can create Forward Lookup Zones. We are running Server 2008 R2 SP1 on our Domain Controllers where DNS is running. Any ideas?

Set permissions for the DnsAdmins group on the DomainDNSZones application partition. To do this, follow these steps:
Click Start, click Run, type Adsiedit.msc, and then click
OK.
In the task pane, right-click ADSI Edit, and then click
Connect to.
Under Connection Point, click Select or type a Distinguished Name or Naming Context, type the following, and then click
OK:
CN=MicrosoftDNS,DC= DomainDNSZones,DC=<var>Domain</var>,DC=<var>Domain_Extension</var>
In the task pane, locate and right-click CN=MicrosoftDNS,DC= DomainDNSZones,DC=<var>Domain</var>,DC=<var>Domain_Extension</var>, and then click
Properties.
Click the Security tab, and then click Advanced. The
Advanced Security Settings for MicrosoftDNS dialog box appears.
In the Permissions tab, click Add.
In the Enter the object name to select box, type DnsAdmins, and then click
Check Names to verify the name.
Click OK. The Permission Entry for Microsoft DNS dialog box appears.
In the Apply onto drop-down list, click This object only.
Click to select the Allow check box for the Full Control
permission, and then click OK.
In the Advanced Security Settings for MicrosoftDNS dialog box, click
Apply, and then click OK.
Click OK to close the properties dialog box for the DomainDNSZones application partition.
Close the ADSI Edit window.
Test whether you can create a new DNS zone now.
If you found this post helpful, please "Vote as Helpful". If it answered your question, remember to "Mark as Answer". MCSE,MSCITP-EA

Remove Old Name Servers from reverse lookup zones in DNS- PowerShell

Hello Scripting Guys,
I'm a long-time fan. Please let me know if I have included enough information for you to provide some guidance. Thank
you!
Here is what I am attempting to do:
import a .csv file which contains
zoneName,hostname,RecordType
and then delete the name server entries from the reverse lookup zones.
Why:
There are hundreds of zones and 80+ name servers in each for a total of about 25,000 records to be removed. I
have the list of zones and the list of name servers which I want to remove from the zones.
Environment:
I am running PowerShell as a Domain Admin with access to DNS. Zones allow secure updates only (if that matters here).
I am running it from a Server 2012 R2 server with the DNS admin tools installed against Server 2008 R2 DNS servers. Current AD functional level Windows Server 2003. All DC are DNS server and GC's.
What I have tried:
The following
works to return all the Name Server records in a zone:
.csv file format
zoneName,hostname,RecordType
1.112.170.in-addr.arpa,nameserver1.contoso.com.,Ns
1.112.170.in-addr.arpa,nameserver2.contoso.com.,Ns
1.112.170.in-addr.arpa,nameserver3.contoso.com.,Ns
2.112.170.in-addr.arpa,nameserver1.contoso.com.,Ns
2.112.170.in-addr.arpa,nameserver2.contoso.com.,Ns
2.112.170.in-addr.arpa,nameserver3.contoso.com.,Ns
Script\Command:
Import-Module DnsServer
$PDCE = Get-ADDomainController -Discover -Service PrimaryDC
import-csv c:\temp\OldNSrecords-test.csv | foreach {
Get-DnsServerResourceRecord -ZoneName $_.zoneName -RRType "Ns" -computerName $PDCE
-Node
OutPut to screen:
HostName RecordType Timestamp TimeToLive RecordData
@ NS 0 1:00:00 Nameserver1.contoso.com
@ NS 0 1:00:00 Nameserver2.contoso.com
However, replacing the business line (in green above after foreach) with the remove command (in red below)
does not work to delete the specific record listed in the .csv, even though it follows the
pattern from MS TechNet:
Remove-DnsServerResourceRecord -ZoneName $_.zoneName -RRType "Ns" -name $_.hostname -computerName
$PDCE
Error:
PS C:\Windows\system32> C:\Temp\OldNSCleanup.ps1
Remove-DnsServerResourceRecord : Failed to get nameserver1.contoso.com. record in
1.112.170.in-addr.arpa zone on PDCE server.
At C:\Temp\OldNSCleanup.ps1:4 char:1
+ Remove-DnsServerResourceRecord -ZoneName $_.zoneName -RRType "Ns" -name $_.name ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (PDCE:root/Microsoft/...rResourceRecord) [Remove-
DnsServerResourceRecord], CimException
+ FullyQualifiedErrorId : WIN32 9714,Remove-DnsServerResourceRecord
When I remove the use of the .csv and put the names of the zone and server in the command, I get the same results.
Fail.
It's as if the record does not exist, but I can browse to it in the GUI. I found
this about Missing Glue records, but it does not seem to apply to reverse lookup NS records. I'm thinking that I need to first load each zone into an assembly and then do the removal,
but I'm not sure how to do that in PowerShell. I tried piping the get command for the zone to the remove command, but that did not work or I did not have the correct syntax.
I have attempted to use DNSCMD to do the same and that command appears to work, but then fails to actually remove
the record.
Here is an example of that command:
import-csv C:\Temp\OldNSrecords-test.csv | foreach {dnscmd.exe "DNSServer.contoso.com" /Recorddelete $_.ZoneName
$_.hostname $_.recordType /f}
Output:
Deleted Ns record(s) at 1.112.170.in-addr.arpa
Command completed successfully. [But not really, the NS record is still there]
I have researched several sites including the suggest one here, but this does not fit my requirement.
http://social.technet.microsoft.com/Forums/scriptcenter/en-US/97070ff2-59e2-4f34-9c39-054048e008af/automatically-delete-removed-dcname-servers-and-automatically-add-new-dcname-servers-in-reverse?forum=winserverDS
http://technet.microsoft.com/en-us/library/jj649872.aspx

Here is a backing store for the root servers in the DNS format:
; formerly NS.INTERNIC.NET
. 3600000 IN NS A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
; formerly NS1.ISI.EDU
. 3600000 NS B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201
; formerly C.PSI.NET
. 3600000 NS C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
; formerly TERP.UMD.EDU
. 3600000 NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
; formerly NS.NASA.GOV
. 3600000 NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
; formerly NS.ISC.ORG
. 3600000 NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
; formerly NS.NIC.DDN.MIL
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
; formerly AOS.ARL.ARMY.MIL
. 3600000 NS H.ROOT-SERVERS.NE
Notice that each is a pair.
One is the NS and the secon is the A record.
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
In this case the dot represents the self reference to the A record. These are the records that bootstrap all of the Internet. Remove them and you ae lost.
The CSV uses the @ to anchor the local domain. Perhaps the DNS CmdLets prefer the dot. The @ is what appears on the screen when we use the GUI. Note the dot at the end of the FQDN. It is required. Even browser use
it but they add it if you forget.
¯\_(ツ)_/¯

Navigation "Back" and "Forward" buttons are inactive, they do not work at all. How do I fix this?

I have downloaded the latest version of firefox and the navigation buttons in the browser will not work in any way. The "Back" and "Forward" buttons are completely un-usable.

Toolbar misbehavior could be due to a problematic add-on (e.g., theme or extension), or a corrupted settings file. Next time you upgrade -- and for security reasons, it is highly recommended -- try Firefox's Safe Mode to see whether you can pin it on an add-on or custom setting. You also could clear your toolbar settings.
More info on Safe Mode:
First, I recommend backing up your Firefox settings in case something goes wrong. See [https://support.mozilla.org/en-US/kb/Backing+up+your+information Backing up your information]. (You can copy your entire Firefox profile folder somewhere outside of the Mozilla folder.)
Next, restart Firefox in [http://support.mozilla.org/kb/Safe+Mode Safe Mode] using
Help > Restart with Add-ons Disabled
In the Safe Mode dialog, do not check any boxes, just click "Continue in Safe Mode."
Does the toolbar work correctly?
More info on clearing toolbar settings: [[Toolbar keeps resetting]]

Firefox 8 and 9beta. Back and Forward buttons greyed out. Right click menu also has forward and back greyed out. Updated all plugins, then disabled all plugins and extensions and started in safe mode. No change.

My forward and back buttons are greyed out after update to Firefox 8. Tried to move to 9 beta, but same behavior. Back and Forward also greyed out in right click menu.
Attempted to fix by updating all plugins and extensions, then disabled all plugins and extensions, and then tried to start in safe mode. Nothing worked.

You could have backed up your profile folder. If you did, [[Recovering important data from an old profile]] can help :)

Safari 2.0.3 - Back and Forward buttons disappeared

The Back and Forward buttons that are normally found next to the address bar have vanished. If you move the mouse over their position and click they show and activate, but is just a blank space when mouse pointer is not there. Have tried reloading them from the toolbar preferences, but the icons dont appear there either, just the space where theyshould be.

Stephen,
Quit Safari, find the com.apple.Safari.plist file in your Macintosh HD/Users/yourusername/Library/Preferences Folder, drag it to the Desktop, and log in/out or restart and let us know what happens.
;~)

Create a new writable folder and change permissions

This is for a customer job; I fix PCs and MACs (mostly PCs) for a living.
(1) How do I create a new writable folder on a BRAND new external HD under OS X (assume 10.5 or 10.6). Note I will first reformat the external usb HD to Apple OS extended using Disk Utility. I will then do Cntrl-I (Apple Key-I) and select reset permissions checkbox at the bottom of the Info window.
ie. I know how to create a writable folder and and rename it under Windows Explorer BUT NOT under OS X Finder.
Please provide step by step instructions. I apologize for asking such a trivial question but I need it for a job in two hours.
(2) After I copy the user home directories from another MAC HD (the other HD is connected via Target Disk to a MAC laptop as well as having the new external HD being connected) someone in another thread on a forum said to do "chmod 777 -R /Volumes/Copied_Folder" to make the resulting copied folders accessible to anyone.
chmod 777 -R /Volumes/Copied_Folder sounds like a DOS command under Windows OS which is entered by creating a DOS window on the Windows Desktop and entering the command in the DOS window.
HOW DO I DO THIS UNDER OS X 10.5 OR 10.6 ?
(3) I do not know what /Volumes means in the command above. Please provide a real life example. i,e Again under Windows we have (for external HDs) F: or G: etc. What are Volumes called under OS X ?
I have connected usb sticks/flash drives to a MAC and copied in needed files but never paid any attention to what the OS X FInder called them. i.e this question (3) is about SYNTAX. I do not know OS X Finder Syntax for Volumes
Again, I apologize for asking such trivial questions.
Regards,
Mike

BDAqua,
I want all security OFF and all access for everyone on external HD.
At jobsite box at bottom of CMD-I properties on entire external HD was ALREADY checked as Ignore OWNERSHIP (not permissions) on drive. Permissions were logged-in-admin account R/W and all other R which is fine as others only need read access going forward. HD was already MAC formatted as I told customer to get a MAC external HD at Best Buy.
Thanks for your reply.
Mike

Msdsc folder and forward lookup zone

Similar Messages

Maybe you are looking for