DNS Dynamic Updates & DNS Scavenging

I was encountering an issue at a customer's site where the DNS records of their client PCs often would be behind or out of sync with the records in DHCP. Usually the IP address would be older in DNS and this was causing issues with scripts executing and network tools correctly resolving client PC hostnames to their correct IP addresses.

I realised I needed to make some changes to their dynamic DNS updating configuration. After a lot of reading through Microsoft's documentation and various online forums, this is what I ended up configuring. Hopefully this may help someone, some day:

- Make the DHCP server a member of the "DnsUpdateProxy" group

- Create a new user account, in the "Users" OU, called "dnsdynamicupdates"

- This new user only needs to be a member of the "Domain Users" group - no special privileges

- Make the password strong and set it to never expire

- Set this new user as the credentials used by the DCHP server in IPv4 Properties | Advanced | Credentials

- Secure the DnsUpdateProxy group by running the following command with Admin privileges:

- dnscmd /config /OpenAclOnProxyUpdates 0

- Set the DHCP server's DNS settings to "Always dynamically update DNS records" in IPv4 Properties | DNS

- Configure DNS Aging values on the DNS server (combined these should be less than the DHCP lease time):

- NoRefresh: 3 days

- Refresh: 3 days

- Set the scavenging period on the DNS server to 4 days (often recommended to be less than the DHCP lease time)

- Set the DHCP lease time to 7 days (as appropriate for your network)

Some good Resources:

- DNS Dynamic Updates: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003

- DNS Scavenging: https://lazyadmin.nl/it/dns-scavenging/

https://chrisbrown.au/techblog/how-dns-aging-and-scavenging-actually-work/

https://techit-services.com/best-practices-for-windows-dns-scavenging/#:~:text=In%20general%2C%20the%20total%20duration,is%20a%20well%2Drecognized%20practice.

Comments

Where are SCANPST.EXE and/or SCANOST.EXE?

I sometimes have to deal with customer computers whose Outlook PST or OST files have become corrupted. Very often the fix is to run SCANPST.EXE on the offending PST/OST file. However, every time I go to do this I forget where the two executable files are. Here is where they are on a Vista machine running Office 2007: C:\Program Files\Microsoft Office\Office12 I hope this helps.

WSUS Issues

Was configuring WSUS on a Server 2016 VM for a customer recently and found the performance to be very sluggish and most of the time the client PCs would time-out and throw an error message when trying to check for updates. After much digging on different forums I came across a fix that worked nicely: Open Internet Information Services (IIS) Manager and click on Application Pools Then Right-Click on your WsusPool instance and choose Advanced Settings Scroll down to Private Memory Limit (KB) and change it from the default of 1843200 to 0 which means unlimited. Then right-click and stop the WsusPool and then start it again. Hope this works for you.

APC PowerChute Network Shutdown - Authentication Phrase

Was installing APC PowerChute Network Shutdown (PCNS) on a customer’s server and couldn’t find a record of the Authentication Passphrase that I set ages back on their Smart UPSes Network Management 2 Card. So I went to reset it on the card and start anew… it took a lot of digging to find it on their particular release of firmware: Go into the UPS tab, then into “shutdown” inside the “Configuration” category: You may then need to change the passphrase being used on other servers. To do this, open up PCNS in your browser and click into the area shown below:

Artifact Weblog

Search This Blog