Windows Server - stand alone windows servers not registering in DNS.

Asked By BlueIT

27-Jan-10 12:04 AM

I have three DHCP and DNS servers (all on domain controllers).  Two
are 2003 R2 and one is 2008 R2.  I introduced the 2008 R2 recently in
anticipation for migration.  The forest and domain level is still 2003
R2.   There are multipe subnets but currently I think the issue is
only happening in one subnet.  All DCs are in the same subnet as the
subnet the issues is occurring in.

For all the stand alone servers, I pass the IP through DHCP
reservations.  We have a combination of 2003 and 2008 stand alone
servers.  We run our in-house applications on these stand alone
servers and rely on both IP and DNS.  Recently I have noticed that
some of the stand alone servers are not registering in DNS.  I am
confident this occurs after a restart and only 2008 servers.  Machine
is pingable by IP.  With the use of a KVM solution, I notice that the
client is getting an IP, subnet mask, gateway and DNS information from
one of the 2003 DHCP servers, but DNS records for that client is
missing.  The cure all is doing the infamous ipconfig /registerdns.
At first I noticed this for one stand alone server (2008) so I
reimaged it for giggles, but it happened again.  Now I am noticing
more machines (2008) experiencing the same problems.  I can say for
sure, it is NOT the same image that is applied on the machines I am
experiencing this with.  This could be happening to user machines also
(XP PRO), but not confident.

I am just suspecting this, but I think this issue might have started
when I introduced the 2008 R2 domain controller as mentioned above.
Might be just plain coincidence.

Any input is welcomed and I will provide additional information if
requested.

Thanks in advance.

26-Jan-10 09:19 PM

Hi BlueIT,

You have not posted specific configuration info such as an ipconfig /all from
the server in question, nor Event log errors, to provide a specific possible
diagnosis, but what I can do is provide a guideline for Dynamic DNS
registration for non-DCs:

1. Primary DNS Suffix must match the zone name in DNS.

2 .DNS zone properties must allow updates

3. Only the DNS servers that have a reference to the zone must be specified
in the machine's IP properties. If a DNS server is specified that has no
reference to the zone, whether through secondaries, stubs, etc, such as
using a router as a DNS address or an ISP's DNS server, it will fail. If
mixing DNS servers that do have a reference to the zone and one that does
not, expect mixed results.

4. You can also set a specific interface to register into a zone in IP
properties of the interface, Advanced button, DNS tab.

5. Using DHCP Option 015 only sets the specific search suffix of the
interface that is set to DHCP.

I hope that helps.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please
contact Microsoft PSS directly. Please check http://support.microsoft.com
for regional support phone numbers.

27-Jan-10 01:15 AM

M. Fekay has pointed you at some things to do to investigate why the
DHCP clients are not successful in registering.  An alternative, of
course, is to get your DHCP server to perform the registration.

27-Jan-10 10:32 AM

in message


Actually to point out, I posted a general guideline for dynamic
registration, DHCP or static clients. But for non-servers, I agree, DHCP
will do the job just fine.

Ace

27-Jan-10 02:13 PM

ote
t...
CP
, is


To add to your request, the DHCP servers and DNS servers are
172.31.244.20, .21 and .22.  The 2008 R2 machine is .22.  As
mentioned, the machine is getting all the required information from
DHCP but not registering in DNS.  The following is an ipconfig /all.
I also reference you guideline as a checkpoint and at par.

Ethernet adapter Local Area Connection 5:

Connection-specific DNS Suffix  . : domain.local
Description . . . . . . . . . . . : Broadcom BCM5708S NetXtreme II
GigE (NDI
VBD Client) #5
Physical Address. . . . . . . . . : 00-22-19-B5-00-CF
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.31.244.49(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, January 26, 2010
4:25:09 PM
Lease Expires . . . . . . . . . . : Friday, January 29, 2010
4:25:13 PM
Default Gateway . . . . . . . . . : 172.31.244.1
DHCP Server . . . . . . . . . . . : 172.31.244.21
DNS Servers . . . . . . . . . . . : 172.31.244.20
172.31.244.21
NetBIOS over Tcpip. . . . . . . . : Enabled

Scope Options                   Vendor
Value                                                 Class
003 Router                         Standard
172.31.244.1                                       None
006 DNS Server                  Standard
172.31.244.20, 172.31.244.21               None
015 DNS Domain Name       Standard
domain.local                                       None

I check the System event viewer logs and came across the following
during the time after the system was back up:
4:26:02 PM  Error Event ID 7001.  This is expect as I have the Base
Engine service disabled.
4:26:35 PM  Error Event ID 7026.  stofit drivers failed to load.

Let me know if you need more information.

27-Jan-10 12:06 PM

http-equiv="Content-Type">
servers are not registering in DNS.<br>
investigate why the DHCP clients are not successful in registering. An
alternative, of course, is to get your DHCP server to perform the
registration.<br>
dynamic registration, DHCP or static clients. But for non-servers, I
agree, DHCP will do the job just fine.<br>
running on all of those machines and <a
href="http://support.microsoft.com/kb/264539">which is responsible for
Dynamic DNS Update registration by a workstation even if the IP address
is statically configured</a>.  Also, by "stand-alone servers", M. Shah
is talking about <em>application</em> servers, for "our in-house
applications" (whatever <em>they</em> are), which are just plain old
workstations as far as Active Directory is concerned.  So I think that
the issues that you quite rightly allude to are not a concern for those
machines.  These <em>are</em> non-servers, from what (little) we are
told.  Having the DHCP server do the work is thus feasible.<br>

27-Jan-10 12:51 PM

in message


Ok, sorry for the misunderstanding. The DHCP Client service on all machines
is important to not disable, since that is the actual registration service.

Ace

27-Jan-10 12:56 PM

Thanks, BlueIT for posting this. This machine apparently appears to be
fine.

I *assume* the DCs are not multihomed (a multihomed DC is defined as
having more than one NIC, IP address and/or RRAS/VPN installed), nor do
they have an outside DNS address (one that does not h ave a reference
to the domain.local zone) configured in their properties. If either is
true, it will complicate the diagnosis and may be the cause.

EventID 7001 & 7026 are generic to specific services, and from what you
mentioned, I do not believe they are related to this issue.

I assume the DHCP Client service is running on the machine. If
disabled, it will still get an IP, however it will not register.

Ace

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit
among responding engineers, and to help others benefit from your
resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE
& MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance,
please contact Microsoft PSS directly. Please check

27-Jan-10 09:12 PM

wrote
t...
DHCP
se, is
CP
II
=A0 =A0172.31.244.21
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 Class
=A0 =A0 =A0 =A0 =A0 None
=A0 =A0 =A0 =A0 =A0 None

27-Jan-10 09:12 PM

wrote
t...
DHCP
se, is
CP
II
=A0 =A0172.31.244.21
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 Class
=A0 =A0 =A0 =A0 =A0 None
=A0 =A0 =A0 =A0 =A0 None

27-Jan-10 04:15 PM

I have have good luck with NewSid.exe  It even works with with Vista without
fouling up the activation if it was activated before the image was made.
it is freeware.

--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

27-Jan-10 09:12 PM

u
out
t,

the image was used with sysprep so that is out of the question.  might
be a whole different topic, but 2008 sysprep does differ from 2003
sysprep.  this same image i used on another machine does not have the
same issue.  I will check out your blog............to be continued.

27-Jan-10 05:33 PM

http-equiv="Content-Type">
type="cite">
machines are imaged. Did you use <code>Sysprep</code>, or are these
machines mirror copies of a base image?<br>
If mirrored copies, I can see what is going on - it has a duplicate SID.<br>
works with with Vista without fouling up the activation if it was
activated before the image was made. it is freeware.<br>
href="http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.aspx">Mark
Russinovich explains that a lot of the thinking that underpins people's
desire to run it in the first place appears to be ill-founded</a>, with
duplicate SIDs not actually being the problem they are often thought to
be.  Hence the tool being retired last year.<br>

27-Jan-10 09:26 PM

in message


Maybe I should have been more specific regarding duplicate SID. My concern
was if the zone is set to allow updates for Secure Only option, a duplicate
SID may cause issues during Kerberos authentication.

Yes, I realize NewSid has been retired. It does work, however, I do not use
it and rather use Sysprep.

For others out there, the following are links on duplicate SIDs, and the
myth surrounding it that one can read up on.

NewSID v4.10, By Mark Russinovich and Bryce Cogswell, Published: November 1,
2006
Note: NewSID has been retired and is no longer available for download.
http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx

Please see Mark Russinovich’s blog post: NewSID Retirement and the Machine
SID Duplication Myth
http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.aspx


The Microsoft KBs regarding duplicate SIDS not being supported have not been
retired. Apparently there must be a good reason for that.

Do not disk duplicate installed versions of WindowsCloning or duplicating an
installation without taking the recommended steps could lead to duplicate
SIDs, and in the case of removable media, ...
http://support.microsoft.com/kb/162001

The Microsoft policy concerning disk duplication of Windows XP ...In the
case of removable media, a duplicate SID might give an account access to ...
Microsoft does not support the running of Sysprep after the image is ...
http://support.microsoft.com/kb/314828

Ace

27-Jan-10 09:42 PM

Good to hear that. As for differences, as far as I know, it acts the
same regarding resetting a machine at boot creating a new SID and other
factors during image booting.

I have not used Sysprep with Windows 2008, however I have with Vista and
Windows 7, and they are similar, and it works fine and have not seen
this issue using it.

Curious, just to touch base when you used Sysprep, and this is out of
curiosity, when you ran it did you use the XML answer method, or did
you use the GUI? If the GUI, I assume you selected the "Generalize"
checkbox (which generates a new SID at boot)?

Also, I found the following KB regarding this issue. It may apply to
your scenario.

A Windows Server 2008-based DHCP server does not register DNS ...Fixes
an issue in which a Windows Server 2008-based DHCP server does not
register DNS records for earlier version DHCP clients that do not send
option 81 to ...
http://support.microsoft.com/kb/967363

And I agree the extended SID topic that ensued is a completely
different topic for another time.



Ace

27-Jan-10 09:59 PM

BluetIT,

I may have posted that KB too soon. I do not think it applies. However,
I have found the following articles that may be of interest.

Sysprep Networking section does not apply - Update to register with DNS
...
http://www.techtalkz.com/windows-deployment/194355-sysprep-networking-section-does-not-apply.html

Also, something else to look into. Thinking back a few weeks ago, I
believe I remember someone posting in another group a similar issue
with Windows 7 not registering. IIRC, from what I remember of the
issue, is I believe that Windows 7 either does not set "register this
connection" or it does not set "append primary DNS" suffix by default
on a fresh installation.

Ace

28-Jan-10 03:11 PM

e:
you
D.
without
de.
ht
me
ors
s
u use
hich
ur
an
r DNS
...
t
..

Altough newsid has saved me in the past, did not work well for 2008 R2
and Win7 for me.  I believed it cause the infamous BSOD.  As for
sysprep, I use the GUI that is local to the machine.  There are only
two System Cleanup Actions:

1.  Enter System Out-of-Box Experience (OOBE).
2.  Enter System Audit Mode.

Don't have option for generating new SID as was the case for 2003
sysprep.  That is why I mention it has change is previous post.  The
zone is definately set up for Secure Only option, although I use

28-Jan-10 03:11 PM

ote:
in
id you
SID.
a without
made.
ight
he
same
ctors
nd
his
you use
(which
your
s an
ter DNS
o ...
ent
g...

28-Jan-10 07:17 PM

Actually, with Sysprep, if you check the 'generalize' checkbox, it
creates a new SID upon boot.

If reverse works, it appears DHCP is registering that record, but the

28-Jan-10 10:04 PM

rote:
in
Did
age?
SID.
ta
mage
might
the
same
actors
and
this
f
you
kbox
your
es an
ster
81 to
rent
,
NS
ing...

30-Jan-10 04:41 PM

te in
.
. Did
image?
te
ista
image
=A0might
3
e the
d.
he
other
a and
n this
of
id you
eckbox
to
ixes
send
ferent
er,
DNS
rking...
is
lt
2

30-Jan-10 04:41 PM

m>
rote
org...
ed.
base
a
Vista
he
or
er from
n't have
ntinued.
the
d
sta
't
ut of
did
ze"
y to
.Fixes
ot
t send
ever,
th DNS
working...
I
ue
this
ault

30-Jan-10 12:30 AM

Hmm, your testing is making this more interesting. Now I am wondering
where the issue is.

So you are saying that it happened a week after the 2008 R2 DC was
introduced. Therefore, I assume your imaged machines were getting a
DHCP configuration without any problems from the 2003 DHCP?

As for upgrading 2003 R2, I agree, I would definitely install fresh,
and besides, I assume 2008 R2 is 64bit and your 2003 R2 is 32bit,
therefore assuming such, it is not upgradeable anyway.

Well, if your further testing does not work, it may be time to make that
phone call to PSS. I would be interested in what they come up with,
which I am sure others following this thread will be curious as well.

Ace

02-Feb-10 07:38 PM

p

I will know in the next couple of weeks if this issue continues.  I
cannot say that it is 2008 R2 since I really have nothing to based my
theory on other than what has changed.  We have multiple sites in our
domain so we will try to upgrade a different site first to see if this
issue can be replicated.  I cannot say when or how long this will
take.

I apreciate all your feedback and tips.

01-Feb-10 06:02 PM

It was my pleasure to try and help. Please do post back with updates
with what you find with the other site.

Thanks!

Ace

03-Feb-10 11:23 PM

e
id
o
e
app
t

Did restart since removing DNS and DHCP off the 2008 R2 domain
controller.  Unfortunately same results.  We are using just 2003 R2
std for our domain controllers for this site.  It does serve as domain
controller for multiple subnets and hundreds of machines.  Maybe I am
reaching here, but could they be over worked?

03-Feb-10 11:23 PM

m.
the
wsid
k.
to
to
C.
n
the
y app
I
t,
g
hat
ur
s

alright...taking another approach to this.  Is there a way to

03-Feb-10 09:20 PM

I am not sure what you mean that your DC serves multiple subnets. Is that how
the AD Site is setup, meaning that there are multiple subnets in that AD
site the DC exists in?

Is the DHCP service offering IP assignments for all of these subnets, too?

For every subnet a DHCP server is set to offer DHCP services, it must have
an IP address configured for that subnet on the DHCP server, unless there is
an IP Helper or DHCP Relay Agent set on a subnet the DHCP server does not
directly communicate with (such as through a router).

However, if your DHCP server is a DC, then you would ONLY want one IP
address on it, or it becomes a multihomed DC, which causes problems with AD
functionality.


Not really, other than bumping up logging on both services and monitoring
the Event logs.

Ace

04-Feb-10 01:34 PM

n
how
?
e
's
AD

What you mentioned is what we have implemented.  Subnets that do not
have a true DHCP server we use DHCP helper commands on network gear.
I was just trying to determine is a DNS server could get overloaded
with request and not register clients.  My last resort is not to
determine if corruption of any kind at this point prior to open up a
case.

Thanks again.

04-Feb-10 10:38 AM

Hi blue,

I am truly out of ideas at this time. My final suggestion, unless
anyone else can chime in with a suggestion, is to call Microsoft PSS at
this point. You've been at this for a couple of weeks now. I hope you
can resolve the issue to prevent any further issues.

Ace

10-Feb-10 09:06 AM

..
R2
ain
am
at how
AD
too?
have
ere's
not
th AD
ing

Ace-

This might be far fetch but have to ask.  Is there any limitation on
the number of DHCP reservations that a DHCP server can handle?  I am
running 2003 R2 Standard and wondering if there is any sort of
limitation.

Thanks

12-Feb-10 12:08 AM

Not that I know of. How many reservations are there?

Ace

17-Feb-10 09:39 PM

About a 100 machines are obtaining IP, Mask, Gateway and DNS from DHCP
reservation.  Now, my thinking is can DHCP/DNS be overwhelmed since
all these machines are restarted concurrently.

18-Feb-10 09:35 AM

About a 100 DHCP clients? That's not much. DHCP can handle thousands, but if
all of them are hitting it at once, it may not be able to handle the burst
in registration requests.

Ace

22-Feb-10 10:02 PM

if
t

Well, since there are two DHCP servers handling the all the clients I
cannot say if it is a burst or not.  If only one DHCP server for all
clients, then I would tend to lead more to overload.

Did a restart today with DNS debugging enabled.  The only odd thing I
notice is a lot of RCODE 5 (REFUSED) for clients, but it seems only
restricted to reverse lookup.  I will continue to analyze the logs to
find a trend, but I am left to support after this.  Example below:

2/22/2010 3:50:48 PM 0668 PACKET  0000000003FEB8B0 UDP Snd
172.31.247.40   6924 R U [05a8       REFUSED] SOA
(3)247(2)31(3)172(7)in-addr(4)arpa(0)
UDP response info at 0000000003FEB8B0
Socket =3D 332
Remote addr 172.31.247.40, port 60557
Time Query=3D1572898, Queued=3D0, Expire=3D0
Buf length =3D 0x0fa0 (4000)
Msg length =3D 0x0080 (128)
Message:
XID       0x6924
Flags     0xa805
QR        1 (RESPONSE)
OPCODE    5 (UPDATE)
AA        0
TC        0
RD        0
RA        0
Z         0
CD        0
AD        0
RCODE     5 (REFUSED)
ZCOUNT    1
PRECOUNT  1
UPCOUNT   2
ARCOUNT   0
ZONE SECTION:
Offset =3D 0x000c, RR count =3D 0
Name      "(3)247(2)31(3)172(7)in-addr(4)arpa(0)"
ZTYPE   SOA (6)
ZCLASS  1
PREREQUISITE SECTION:
Offset =3D 0x0029, RR count =3D 0
Name      "(2)40(3)247(2)31(3)172(7)in-addr(4)arpa(0)"
TYPE   CNAME  (5)
CLASS  254
TTL    0
DLEN   0
DATA   (none)
UPDATE SECTION:
Offset =3D 0x004f, RR count =3D 0
Name      "[C029](2)40(3)247(2)31(3)172(7)in-addr(4)arpa(0)"
TYPE   PTR  (12)
CLASS  255
TTL    0
DLEN   0
DATA   (none)
Offset =3D 0x005b, RR count =3D 1
Name      "[C029](2)40(3)247(2)31(3)172(7)in-addr(4)arpa(0)"
TYPE   PTR  (12)
CLASS  1
TTL    1200
DLEN   25
DATA   (5)machine1(11)mydomain(5)local(0)
ADDITIONAL SECTION:
empty

23-Feb-10 02:27 AM

It could be a possibility that because it is already registered, it
cannot update it is own recorsd if it is a stand alone when updates are
set to secure, or if you have DHCP to update everything no matter if a
client asks or not, the DHCP owner may be DHCP1, but DHCP2 is trying to
update the record, but it does not own it, which is one of the drawbacks
if using credentials, which then the DnsProxyDUpate will work, but
that;s only meant for DCs.

That was just conjecture...

As I mentioned before, you may only be a phone call away. I believe
your first post was 1/26/2010. A month has almost gone by and still not
working. I guess it is not that critical or you would have called by
now?

Ace

01-Mar-10 11:23 AM

..
P
but if
urst
0)"
0)"

29-Apr-10 11:01 AM

m...
HCP
ce
, but
the
I
to
a(0)"
a(0)"
o
s

29-Apr-10 11:12 AM

com...
DHCP
ince
ds, but
e the
I
ll
ng I
s to
rpa(0)"
rpa(0)"