DNS Dynamic Updates & DNS Scavenging

I was encountering an issue at a customer's site where the DNS records of their client PCs often would be behind or out of sync with the records in DHCP. Usually the IP address would be older in DNS and this was causing issues with scripts executing and network tools correctly resolving client PC hostnames to their correct IP addresses.

I realised I needed to make some changes to their dynamic DNS updating configuration. After a lot of reading through Microsoft's documentation and various online forums, this is what I ended up configuring. Hopefully this may help someone, some day:

- Make the DHCP server a member of the "DnsUpdateProxy" group

Create a new user account, in the "Users" OU, called "dnsdynamicupdates"

- This new user only needs to be a member of the "Domain Users" group - no special privileges

- Make the password strong and set it to never expire

- Set this new user as the credentials used by the DCHP server in IPv4 Properties | Advanced | Credentials

- Secure the DnsUpdateProxy group by running the following command with Admin privileges:

- dnscmd /config /OpenAclOnProxyUpdates 0

- Set the DHCP server's DNS settings to "Always dynamically update DNS records" in IPv4 Properties | DNS

- Configure DNS Aging values on the DNS server (combined these should be less than the DHCP lease time):

- NoRefresh: 3 days

- Refresh: 3 days

- Set the scavenging period on the DNS server to 4 days (often recommended to be less than the DHCP lease time)

- Set the DHCP lease time to 7 days (as appropriate for your network)

Some good Resources:

- DNS Dynamic Updates: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003

- DNS Scavenging: https://lazyadmin.nl/it/dns-scavenging/

https://chrisbrown.au/techblog/how-dns-aging-and-scavenging-actually-work/

https://techit-services.com/best-practices-for-windows-dns-scavenging/#:~:text=In%20general%2C%20the%20total%20duration,is%20a%20well%2Drecognized%20practice.

Comments

Where are SCANPST.EXE and/or SCANOST.EXE?

I sometimes have to deal with customer computers whose Outlook PST or OST files have become corrupted. Very often the fix is to run SCANPST.EXE on the offending PST/OST file. However, every time I go to do this I forget where the two executable files are. Here is where they are on a Vista machine running Office 2007: C:\Program Files\Microsoft Office\Office12 I hope this helps.

Resolve WSUS Server issue that gives "Cannot save configuration because the server is still processing"

This is a pretty infuriating error and can sometimes crop up as a result of running a "wsusutil reset" command. First of all, give the server some time, and then a bit more... but you've probably already done this. These steps may help to resolve the situation: - Install Microsoft SQL Management Studio (free download) - Run SQL Management Studio and start to connect to the WSUS database - Enter this in the "Server Name" box: \\.\pipe\MICROSOFT##WID\tsql\query - Expand the "Databases" tree - Right-click on "SUSDB" and choose "New Query" - Paste this query in: UPDATE tbSingletonData SET ResetStateMachineNeeded = 0 - You should see a message like "1 row affected", which is good - Quit SQL Management Studio - Open "Services" and restart the "WSUS Service" - Now, open WSUS

Unable to Extend Volume because the Windows Recovery Partition is in the way

I had to increase the space allocated to a customer's WSUS server VM that had run out of capacity and was keeling over. So I powered off the VM, added the extra capacity to the virtual hard disk, powered it back on, and went into Disk Management to extend the C: drive partition. However, I discovered that because the Windows Recovery Partition was in between the C: partition and the new unallocated space (similar to the image below which I've copied from Woshub.com ), I was unable to do an "Extend Volume" job. The solution was to move the recovery partition. This involves disabling it, deleting it, extending your partition as required, and then re-creating the recovery partition and enabling it. Here are the steps involved: Disable existing recovery partition: You will need to disable the existing Windows recovery partition. To do this, run this command from an admin command line/PowerShell: reagentc /disable If you get the error message "REAGENTC.EXE: Operati...

Artifact Weblog

Search This Blog