The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows administrators to manage and automate the assignment of IP addresses in a centralized console. Without DHCP, the IP address must be “statically” configured on each computer. This isn’t such a big deal in a small (ten client-or-less) environment, but when you get into significantly larger environments, static IP address management can become a nightmare. Factor in the mobility of using laptops, and the need to be able to connect to other networks dynamically, and you’ll find it’s almost impossible in today’s world not to use DHCP.
The way DHCP works is fairly simple. Using a client/server model, a DHCP server maintains a pool of IP addresses. DHCP clients request and obtain leases for IP addresses during the boot process. DHCP was derived from the Bootstrap Protocol (BOOTP), which was a protocol typically used to allow clients to boot from the network rather than from a hard drive. Through this boot process, BOOTP assigned an IP address dynamically to the client computer. Some benefits of using a Windows Server 2008 DHCP server include:
DNS integration. Windows Server 2008 DHCP integrates directly with DDNS. When a computer obtains a lease for an IP address, the DHCP server can then register or update the computer’s Address (A) records and pointer (PTR) records in the DNS database via Dynamic DNS on behalf of the client computer. The result of the two—DHCP used with DDNS—is true dynamic IP address management. Any computer can start up on the network and receive an IP address that is further registered in the DNS name server.
Multicast address allocation. The Windows Server 2008 DHCP can assign IP addresses to multicast groups in addition to the standard individual hosts. Multicast addresses are used to communicate with groups such as server clusters using network load balancing.
Detection of unauthorized DHCP servers. By restricting DHCP servers to those that are authorized, you can prevent conflicts and problems on the network. An administrator must configure Active Directory to recognize the DHCP server before it begins functioning on the network. The Windows Server 2008 DHCP service contacts Active Directory to determine whether it is an authorized DHCP server. Active Directory also enables you to configure which clients a DHCP server can service.
Enhanced monitoring. With the Windows Server 2008 DHCP service, you have the ability to monitor the pool of IP addresses and receive notification when the address pool is utilized at a threshold level. For example, you might monitor for a threshold of 90 percent or above.
Vendor and user classes. Vendor and user classes enable you to distinguish the types of machines that are obtaining DHCP leases. For example, you can use a predefined class to determine which users are remote access clients.
Clustering. Windows Server 2008 DHCP services support clustering. Through a cluster, you can ensure a higher reliability and availability of DHCP services to clients.
The negotiation process consists of only four messages, two from the client and two from the server. The first message is the DHCP Discover message from the client to the server. This message looks to a DHCP server and asks for an IP address lease. The second message is the DHCP Offer message responding from the server to the client. A DHCP Offer tells the client that the server has an IP address available. The third message is a DHCP Request message from the client to the server. In this message, the client accepts the offer and requests the IP address for lease. The fourth and final message is the DHCP Acknowledge message from the server to the client. With the DHCP Acknowledge message, the server officially assigns the IP address lease to the client. Each DHCP server requires a statically applied IP address.
DHCP was originally introduced in RFC 2131 back in March of 1997 (http://www.rfceditor.org/rfc/rfc2131.txt). Since the inception of DHCP, a number of add-on DHCP options have made it possible to disburse even more IP-related information to clients, making IP management much more flexible for IT administrators.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Windows Server 2008 DNS - Configuring Zone Resolution
There is a new name resolution available with the release of Windows Server 2008: GlobalNames Zones. The GlobalNames zone was introduced to help phase out the Windows Internet Naming Service (WINS), which we will discuss later. However, it is important to note that the GlobalNames zone is not intended to support the same type of name resolution provided in WINS, records which typically are not managed by IT administrators. After the configuration of the GlobalNames zone, you are responsible for management of all records in the zone, as there are no dynamic updates.
So, where this is really relevant is within organizations that have multiple domain names. Without single-label names (also known as NetBIOS names), Windows-based computers will append DNS suffixes based on the order provided, either via the individual TCP/IP settings of the client, DHCP settings, or Group Policy settings. Again, the key here is that if there are MULTIPLE domain names an organization must manage, they may find it easier to use the GlobalNames zone since the GlobalNames zone records can be configured globally for the single-label names. Records that are contained within the GlobalNames zone are known as global names.
Several prerequisites must be met before using the GlobalNames zone:
• No existing DNS zone can be named GlobalNames.
• All authoritative DNS servers must be running Windows Server 2008.
• All DNS servers running on Windows Server 2008 must store a local copy of the GlobalNames zone or must be able to remotely communicate with a server that does.
• The GlobalNames Zone Registry setting must be enabled on the server. This can be done by typing dnscmd/config /enableglobalnamessupport 1.
Let’s walk through the steps in configuring a GlobalNames zone:
1. Choose Start.
2. Right-click Command Prompt and select Run As Administrator.
3. At the command prompt, type dnscmd/config/enableglobalnamessupport 1.
4. Close the command-line prompt.
5. Select Start Administrative Tools DNS.
6. Right-click your DNS server, and then click New Zone to open the New Zone Wizard.
7. Create a new zone and give it the name GlobalNames.
8. Complete the remaining configuration options as we have done previously, and then click Finish to complete the process.
Next, we will create a CNAME record for use with the GlobalNames zone:
1. Right-click the GlobalNames zone now available under the Forward Lookup Zones.
2. Select New Alias (CNAME).
3. Enter the alias of the server. For example, we can name it widgetserver.
4. Enter the FQDN of the target host. In this case, it will be our DNS server for testing purposes: dc1.uccentral.ads. If you do not have a record for your server, you may need to stop the CNAME process, and create an A record in the primary zone for your domain.
5. Click OK.
To test the GlobalNames zone record, simply go to the command prompt of a client PC and type ping gnztest. This will return the IP address as expected.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
So, where this is really relevant is within organizations that have multiple domain names. Without single-label names (also known as NetBIOS names), Windows-based computers will append DNS suffixes based on the order provided, either via the individual TCP/IP settings of the client, DHCP settings, or Group Policy settings. Again, the key here is that if there are MULTIPLE domain names an organization must manage, they may find it easier to use the GlobalNames zone since the GlobalNames zone records can be configured globally for the single-label names. Records that are contained within the GlobalNames zone are known as global names.
Several prerequisites must be met before using the GlobalNames zone:
• No existing DNS zone can be named GlobalNames.
• All authoritative DNS servers must be running Windows Server 2008.
• All DNS servers running on Windows Server 2008 must store a local copy of the GlobalNames zone or must be able to remotely communicate with a server that does.
• The GlobalNames Zone Registry setting must be enabled on the server. This can be done by typing dnscmd
Let’s walk through the steps in configuring a GlobalNames zone:
1. Choose Start.
2. Right-click Command Prompt and select Run As Administrator.
3. At the command prompt, type dnscmd
4. Close the command-line prompt.
5. Select Start Administrative Tools DNS.
6. Right-click your DNS server, and then click New Zone to open the New Zone Wizard.
7. Create a new zone and give it the name GlobalNames.
8. Complete the remaining configuration options as we have done previously, and then click Finish to complete the process.
Next, we will create a CNAME record for use with the GlobalNames zone:
1. Right-click the GlobalNames zone now available under the Forward Lookup Zones.
2. Select New Alias (CNAME).
3. Enter the alias of the server. For example, we can name it widgetserver.
4. Enter the FQDN of the target host. In this case, it will be our DNS server for testing purposes: dc1.uccentral.ads. If you do not have a record for your server, you may need to stop the CNAME process, and create an A record in the primary zone for your domain.
5. Click OK.
To test the GlobalNames zone record, simply go to the command prompt of a client PC and type ping gnztest. This will return the IP address as expected.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Windows Server 2008 DNS Reverse Lookup Zones
A reverse lookup zone is an authoritative DNS zone that is used primarily to resolve IP addresses to network resource names. This zone type can be primary, secondary, or Active Directory–integrated. Reverse lookups traverse the DNS hierarchy in exactly the same way as the more common forward lookups. To handle reverse lookups, a special root domain called in-addr.arpa was created. Subdomains within the in-addr.arpa domain are created using the reverse ordering of the octets that form an IP address. For example, the reverse lookup domain for the 192.168.100.0/24 network would be 100.168.192.in-addr.arpa. The reason the IP addresses are inverted is that IP addresses, when read from left to right, get more specific; the IP address starts with the more general information first. FQDNs, in contrast, get more general when read from left to right; the FQDN starts with a specific host name. In order for reverse lookup zones to work properly, they use a special RR called a PTR record that provides the mapping of the IP address in the zone to the FQDN. Reverse lookup zones are used by certain applications, such as NSLookup (an important diagnostic tool that should be part of every DNS administrator’s arsenal). If a reverse lookup zone is not configured on the server to which NSLookup is pointing, you will get an error message when you invoke the nslookup command.
Security Considerations for the Presence of a Reverse Lookup Zone
Being able to make NSLookup work against your DNS servers is not the only, or most important, reason why you should configure reverse lookup zones. Applications on your internal network, such as DNS clients that are trying to register PTR records in a reverse lookup zone, can “leak” information about your internal network out to the Internet if they cannot find a reverse lookup zone on the intranet. To prevent this information from leaking from your network, you should configure reverse lookup zones for the addresses in use on your network.
Configuring Reverse Lookup Zones
Now, we need to create a matching reverse lookup zone. This will handle reverse resolution for our subnet. In this case, it is 192.168.1.x.
1. Choose Start Administrative Tools DNS.
2. In the console tree, click Reverse Lookup Zones.
3. Right-click Reverse Lookup Zones, and then click New Zone.
4. When the New Zone Wizard appears, click Next.
5. On the Zone Type page, select Primary Zone, and then click Next.
6. On the Reverse Lookup Zone Name page, make sure IPv4 is selected, and then click Next.
7. On the Reverse Lookup Zone Name page, in the Network ID field, type the start of the subnet range of your network (in this case, 192.168.1.x), and then click Next.
8. On the Zone File page, click Next.
9. On the Dynamic Update page, click Next.
10. On the Completing The New Zone Wizard page, click Finish.
Now we need to enable IPv6 so we can offer domain name resolution for clients who may use IPv6 as opposed to IPv4. We’re also going to need it if we want to enable IPv6 DHCP addressing. First, we need to set an IPv6 address for our server. To do so, perform the following steps:
1. Choose Start and right-click Network.
2. Select Properties from the drop-down menu.
3. Click Manage Network Connections.
4. Right-click the Network connection and choose Properties.
5. Double-click Internet Protocol Version 6 (TCP/IPv6).
6. Click the radio button for Use The Following IPv6 Address. If you are not familiar with IP addressing, you can use 2001:0db8:29cd:1a0f:857b:455b:b4ec:7403.
7. Enter a Subnet prefix length of 64.
8. Your preferred DNS server would be the same as that mentioned earlier (your IPv6 address).
9. Close the Network Connections window and re-open the DNS administrator console.
10. In the console tree, click Reverse Lookup Zones.
11. Right-click Reverse Lookup Zones, and then click New Zone.
12. When the New Zone Wizard appears, click Next.
13. On the Zone Type page, select Primary Zone, and then click Next.
14. On the Reverse Lookup Zone Name page, make sure IPv6 is selected, and then click Next.
15. In the Reverse Lookup Zone Name field, type in the prefix 2001:0db8:29cd:1a0f::/64, and then click Next.
16. On the Dynamic Update page, choose Allow Both Nonsecure And Secure Dynamic Updates, and click Next.
17. Click Finish to create the New Zone.
18. To create an IPv6 record, right-click the Primary Lookup Zone for your domain (in our lab, it is uccentral.ads), and then click New Host.
19. In the Name field, enter the name of your server. Our server name is dc1.
20. In the IP address field, enter the IPv6 address we set for the server.
21. Verify that Create Associated Pointer (PTR) Record is checked, and click Add Host.
You should now see a new AAAA record for the server, as well as a new PTR record in the Reverse Lookup Zone we created.
Now you can double-click the Forward Lookup Zones and Reverse Lookup Zones and view the zones you have created. The zones will be displayed in the console pane under the appropriate zone type. From here, you can add records by right-clicking the zone and selecting the type of record you want to create. Likewise, you can right-click the zone and select Properties to modify the properties of the zone. Some of the properties you can modify include:
• Dynamic Updates: The ability for clients to automatically update DNS records.
• Zone Type: You can change a zone type from Primary, to Secondary, or to Stub Zone. If Active Directory is installed, you can also make the zone Active Directory–integrated.
• WINS integration: This is where you can involve WINS resolution with DNS resolution.
• Name Servers: You can add the names and IP addresses of servers that have the rights to create copies of the DNS zone.
• Zone Transfer: Here, you can specify whether the zone can be transferred to another DNS server. You can also specify whether it can be transferred to any server, only the servers in the Name Servers tab (discussed earlier), or to only specific DNS servers by IP address or FQDN.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Security Considerations for the Presence of a Reverse Lookup Zone
Being able to make NSLookup work against your DNS servers is not the only, or most important, reason why you should configure reverse lookup zones. Applications on your internal network, such as DNS clients that are trying to register PTR records in a reverse lookup zone, can “leak” information about your internal network out to the Internet if they cannot find a reverse lookup zone on the intranet. To prevent this information from leaking from your network, you should configure reverse lookup zones for the addresses in use on your network.
Configuring Reverse Lookup Zones
Now, we need to create a matching reverse lookup zone. This will handle reverse resolution for our subnet. In this case, it is 192.168.1.x.
1. Choose Start Administrative Tools DNS.
2. In the console tree, click Reverse Lookup Zones.
3. Right-click Reverse Lookup Zones, and then click New Zone.
4. When the New Zone Wizard appears, click Next.
5. On the Zone Type page, select Primary Zone, and then click Next.
6. On the Reverse Lookup Zone Name page, make sure IPv4 is selected, and then click Next.
7. On the Reverse Lookup Zone Name page, in the Network ID field, type the start of the subnet range of your network (in this case, 192.168.1.x), and then click Next.
8. On the Zone File page, click Next.
9. On the Dynamic Update page, click Next.
10. On the Completing The New Zone Wizard page, click Finish.
Now we need to enable IPv6 so we can offer domain name resolution for clients who may use IPv6 as opposed to IPv4. We’re also going to need it if we want to enable IPv6 DHCP addressing. First, we need to set an IPv6 address for our server. To do so, perform the following steps:
1. Choose Start and right-click Network.
2. Select Properties from the drop-down menu.
3. Click Manage Network Connections.
4. Right-click the Network connection and choose Properties.
5. Double-click Internet Protocol Version 6 (TCP/IPv6).
6. Click the radio button for Use The Following IPv6 Address. If you are not familiar with IP addressing, you can use 2001:0db8:29cd:1a0f:857b:455b:b4ec:7403.
7. Enter a Subnet prefix length of 64.
8. Your preferred DNS server would be the same as that mentioned earlier (your IPv6 address).
9. Close the Network Connections window and re-open the DNS administrator console.
10. In the console tree, click Reverse Lookup Zones.
11. Right-click Reverse Lookup Zones, and then click New Zone.
12. When the New Zone Wizard appears, click Next.
13. On the Zone Type page, select Primary Zone, and then click Next.
14. On the Reverse Lookup Zone Name page, make sure IPv6 is selected, and then click Next.
15. In the Reverse Lookup Zone Name field, type in the prefix 2001:0db8:29cd:1a0f::/64, and then click Next.
16. On the Dynamic Update page, choose Allow Both Nonsecure And Secure Dynamic Updates, and click Next.
17. Click Finish to create the New Zone.
18. To create an IPv6 record, right-click the Primary Lookup Zone for your domain (in our lab, it is uccentral.ads), and then click New Host.
19. In the Name field, enter the name of your server. Our server name is dc1.
20. In the IP address field, enter the IPv6 address we set for the server.
21. Verify that Create Associated Pointer (PTR) Record is checked, and click Add Host.
You should now see a new AAAA record for the server, as well as a new PTR record in the Reverse Lookup Zone we created.
Now you can double-click the Forward Lookup Zones and Reverse Lookup Zones and view the zones you have created. The zones will be displayed in the console pane under the appropriate zone type. From here, you can add records by right-clicking the zone and selecting the type of record you want to create. Likewise, you can right-click the zone and select Properties to modify the properties of the zone. Some of the properties you can modify include:
• Dynamic Updates: The ability for clients to automatically update DNS records.
• Zone Type: You can change a zone type from Primary, to Secondary, or to Stub Zone. If Active Directory is installed, you can also make the zone Active Directory–integrated.
• WINS integration: This is where you can involve WINS resolution with DNS resolution.
• Name Servers: You can add the names and IP addresses of servers that have the rights to create copies of the DNS zone.
• Zone Transfer: Here, you can specify whether the zone can be transferred to another DNS server. You can also specify whether it can be transferred to any server, only the servers in the Name Servers tab (discussed earlier), or to only specific DNS servers by IP address or FQDN.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Windows Server 2008 DNS Active Directory Records
If you turned on dynamic updates in the previous sidebar, and you have Active Directory loaded on your server, reboot your system. After your system reboots, notice the following new records in your zone.
• _ldap._tcp. Enables a client to locate a domain controller in the domain named by . A client searching for a domain controller in the domain uccentral.ads would query the DNS server for _ldap._uccentral.ads.
• _ldap._tcp.._sites. Enables a client to find a domain controller in the domain and site specified (such as _ldap._tcp.lab._sites.uccentral.ads for a domain controller in the Lab site of uccentral.ads).
• _ldap._tcp.pdc._msdcs. Enables a client to find the PDC Emulator flexible single master operations (FSMO) role holder of a mixed- or native-mode domain. Only the PDC of the domain registers this record.
• _ldap._tcp.gc._msdcs. Found in the zone associated with the root domain of the forest, this enables a client to find a Global Catalog (GC) server. Only domain controllers serving as GC servers for the forest will register this name. If a server ceases to be a GC server, the server will deregister the record.
• _ldap._tcp. ._sites.gc._msdcs. Enables a client to find a GC server in the specified site (such as _ldap._tcp.lab._sites.gc._msdcs. uccentral.ads).
• _ldap._tcp..domains._msdcs. Enables a client to find a domain controller in a domain based on the domain controller’s globally unique ID (GUID). A GUID is a 128-bit (8 byte) number that is generated automatically for the purpose of referencing Active Directory objects. This mechanism and these records are used by domain controllers to locate other domain controllers when they need to replicate, for example.
•Enables a client to find a domain controller via a normal Host (A) record.
Special records specifically associated with Active Directory allow servers and clients to interact with Active Directory services in a meaningful way.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
• _ldap._tcp.
• _ldap._tcp.
• _ldap._tcp.pdc._msdcs.
• _ldap._tcp.gc._msdcs.
• _ldap._tcp. ._sites.gc._msdcs.
• _ldap._tcp.
•
Special records specifically associated with Active Directory allow servers and clients to interact with Active Directory services in a meaningful way.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Windows Server 2008 DNS Zone Transfer
Zone transfer is the process of copying the contents of the zone file on a primary DNS server to a secondary DNS server. Using zone transfer provides fault tolerance by synchronizing the zone file in a primary DNS server with the zone file in a secondary DNS server. The secondary DNS server can continue performing name resolution if the primary DNS server fails. Furthermore, secondary DNS servers can transfer to other secondary DNS servers in the same hierarchical fashion, which makes the higher-level secondary DNS server a master to other secondary servers. Three transfer modes are used in a Windows Server 2008 DNS configuration:
• Full Transfer. When you bring a new DNS server online and configure it to be a secondary server for an existing zone in your environment, it will perform a full transfer of all the zone information in order to replicate all the existing resource records for that zone. Older implementations of the DNS service also used full transfers whenever updates to a DNS database needed to be propagated. Full zone transfers can be very time-consuming and resource-intensive, especially in situations where there isn’t sufficient bandwidth between primary and secondary DNS servers. For this reason, incremental DNS transfers were developed.
• Incremental Transfer. When using incremental zone transfers, the secondary server retrieves only resource records that have changed within a zone, so that it remains synchronized with the primary DNS server. When incremental transfers are used, the databases on the primary server and the secondary server are compared to see if any differences exist. If the zones are identified as the same (based on the serial number of the Start of Authority resource record), no zone transfer is performed. If, however, the serial number on the primary server database is higher than the serial number on the secondary server, a transfer of the delta resource records commences. Because of this configuration, incremental zone transfers require much less bandwidth and create less network traffic, allowing them to finish faster. Incremental zone transfers are often ideal for DNS servers that must communicate over low-bandwidth connections.
• DNS Notify. The third method for transferring DNS zone records isn’t actually a transfer method at all. To avoid the constant polling of primary DNS servers from secondary DNS servers, DNS Notify was developed as a networking standard (RFC 1996) and has since been implemented into the Windows operating system. DNS Notify allows a primary DNS server to utilize a “push” mechanism for notifying secondary servers that it has been updated with records that need to be replicated. Servers that are notified can then initiate a zone transfer (either full or incremental) to “pull” zone changes from their primary servers as they normally would. In a DNS Notify configuration, the IP addresses for all secondary DNS servers in a DNS configuration must be entered into the notify list of the primary DNS server to pull, or request, zone updates.
Each of the three methods has its own purpose and functionality. How you handle zone transfers between your DNS servers depends on your individual circumstances. The full and incremental transfers actually transfer the data between the DNS servers, and that DNS Notify is not a mechanism for transferring zone data. It is used in conjunction with AXFR (Full Transfer) and IXFR (Incremental Transfer) to notify a secondary server that new records are available for transfer.
How to create a new DNS zone:
1. Choose Start Administrative Tools DNS.
2. In the console tree, double-click your server, and then click Forward Lookup Zones.
3. Right-click Forward Lookup Zones, and then select New Zone.
4. The New Zone Wizard appears. Click Next.
5. On the Zone Type page, click Primary zone and then click Next.
6. On the Active Directory Zone Replication Scope page, click Next.
7. On the Zone Name page, in the Name field, type a name for a test zone, and then click Next.
8. On the Zone File page, click Next.
9. On the Dynamic Update page, choose Allow Both Nonsecure And Secure Dynamic Updates and click Next.
Normally, when configuring Dynamic Updates, you should choose the Secure Only option. For lab purposes in this book, however, you can choose Allow Both Nonsecure And Secure Dynamic Updates.
10. On the Completing The New Zone Wizard page, click Finish.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
• Full Transfer. When you bring a new DNS server online and configure it to be a secondary server for an existing zone in your environment, it will perform a full transfer of all the zone information in order to replicate all the existing resource records for that zone. Older implementations of the DNS service also used full transfers whenever updates to a DNS database needed to be propagated. Full zone transfers can be very time-consuming and resource-intensive, especially in situations where there isn’t sufficient bandwidth between primary and secondary DNS servers. For this reason, incremental DNS transfers were developed.
• Incremental Transfer. When using incremental zone transfers, the secondary server retrieves only resource records that have changed within a zone, so that it remains synchronized with the primary DNS server. When incremental transfers are used, the databases on the primary server and the secondary server are compared to see if any differences exist. If the zones are identified as the same (based on the serial number of the Start of Authority resource record), no zone transfer is performed. If, however, the serial number on the primary server database is higher than the serial number on the secondary server, a transfer of the delta resource records commences. Because of this configuration, incremental zone transfers require much less bandwidth and create less network traffic, allowing them to finish faster. Incremental zone transfers are often ideal for DNS servers that must communicate over low-bandwidth connections.
• DNS Notify. The third method for transferring DNS zone records isn’t actually a transfer method at all. To avoid the constant polling of primary DNS servers from secondary DNS servers, DNS Notify was developed as a networking standard (RFC 1996) and has since been implemented into the Windows operating system. DNS Notify allows a primary DNS server to utilize a “push” mechanism for notifying secondary servers that it has been updated with records that need to be replicated. Servers that are notified can then initiate a zone transfer (either full or incremental) to “pull” zone changes from their primary servers as they normally would. In a DNS Notify configuration, the IP addresses for all secondary DNS servers in a DNS configuration must be entered into the notify list of the primary DNS server to pull, or request, zone updates.
Each of the three methods has its own purpose and functionality. How you handle zone transfers between your DNS servers depends on your individual circumstances. The full and incremental transfers actually transfer the data between the DNS servers, and that DNS Notify is not a mechanism for transferring zone data. It is used in conjunction with AXFR (Full Transfer) and IXFR (Incremental Transfer) to notify a secondary server that new records are available for transfer.
How to create a new DNS zone:
1. Choose Start Administrative Tools DNS.
2. In the console tree, double-click your server, and then click Forward Lookup Zones.
3. Right-click Forward Lookup Zones, and then select New Zone.
4. The New Zone Wizard appears. Click Next.
5. On the Zone Type page, click Primary zone and then click Next.
6. On the Active Directory Zone Replication Scope page, click Next.
7. On the Zone Name page, in the Name field, type a name for a test zone, and then click Next.
8. On the Zone File page, click Next.
9. On the Dynamic Update page, choose Allow Both Nonsecure And Secure Dynamic Updates and click Next.
Normally, when configuring Dynamic Updates, you should choose the Secure Only option. For lab purposes in this book, however, you can choose Allow Both Nonsecure And Secure Dynamic Updates.
10. On the Completing The New Zone Wizard page, click Finish.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Configuring Windows Server 2008 DNS Zones
Simply put, a zone is the namespace allocated for a particular server. Each “level” of the DNS hierarchy represents a particular zone within DNS. For the actual DNS database, a zone is a contiguous portion of the domain tree that is administered as a single separate entity by a DNS server. The zone contains resource records for all of the names within the zone. If Active Directory–integrated zones are not being used, some zone files will contain the DNS database resource records required to define the zone. If DNS data is Active Directory–integrated, the data is stored in Active Directory, not in zone files.
• Primary Zone. With a primary zone, the server hosting this zone is authoritative for the domain name. It stores the master copy of the domain information locally. When the zone is created, a file with the suffix .dns is created in the %windir%\System32\dns subdirectory of the DNS server.
• Secondary Zone. This is a secondary source—essentially a copy—of the primary DNS zone, with read-only capabilities.
• Stub Zone. Only stores information about the authoritative name servers for a particular zone.
Primary and secondary zones are standard (that is, non-Active Directory–integrated) forward lookup zones. The principal difference between the two is the ability to add records. A standard primary zone is hosted on the master servers in a zone replication scheme. Primary zones are the only zones that can be edited, whereas secondary zones are read-only and are updated only through zone transfer. DNS master servers replicate a copy of their zones to one or more servers that host secondary zones, thereby providing fault tolerance for your DNS servers. DNS standard zones are the types of zones you should use if you do not plan on integrating Active Directory with your DNS servers.
An Active Directory–integrated zone is basically an enhanced primary DNS zone stored in Active Directory and thus can, unlike all other zone types, use multimaster replication and Active Directory security features. It is an authoritative primary zone in which all of the zone data is stored in Active Directory. As mentioned previously, zone files are not used nor necessary. Integrating DNS with Active Directory produces the following additional benefits:
• Speed. Directory replication is much faster when DNS and Active Directory are integrated. This is because Active Directory replication is performed on a per-property basis, meaning that only changes that apply to particular zones are replicated. Because only the relevant information is to be replicated, the time required to transfer data between zones is greatly reduced. On top of this, a separate DNS replication topology is eliminated because Active Directory replication topology is used for both ADI zones and AD itself.
• Reduced Administrative Overhead. Any time you can reduce the number of management consoles you have to work with, you can reduce the amount of time needed to manage information. Without the advantage of consolidating the management of DNS and Active Directory in the same console, you would have to manage your Active Directory domains and DNS namespaces separately. Moreover, your DNS domain structure mirrors your Active Directory domains. Any deviation between Active Directory and DNS makes management more time-consuming and creates more opportunity for mistakes. As your network continues to grow and become more complex, managing two separate entities becomes more involved. Integrating Active Directory and DNS provides you with the ability to view and manage them as a single entity.
• Automatic Synchronization. When a new domain controller is brought online, networks that have integrated DNS and Active Directory have the advantage of automatic synchronization. Even if a domain controller will not be used to host the DNS service, the ADI zones will still be replicated, synchronized, and stored on the new domain controllers.
• Secure Dynamic. DNS Additional features have been added that enhance the security of secure dynamic updates.
A reverse lookup zone is an authoritative DNS zone that is used primarily to resolve IP addresses to network resource names. This zone type can be primary, secondary or Active Directory–integrated. Reverse lookups traverse the DNS hierarchy in exactly the same way as the more common forward lookups.
Stub zones are a new feature introduced in Windows Server 2008. They contain a partial copy of a zone that can be hosted by a DNS server and used to resolve recursive or iterative queries. A recursive query is a request from a host to a resolver to find data on other name servers. An s query is a request, usually made by a resolver, for any information a server already has in memory for a certain domain name. Stub zones contain the Start of Authority (SOA) resource records of the zone, the DNS resource records that list the zone’s authoritative servers, and the glue address (A) resource records that are required for contacting the zone’s authoritative servers. Stub zones are useful for reducing the number of DNS queries on a network, and consequently the resource consumption on the primary DNS servers for that particular namespace. Basically, stub zones are used to find other zones and can be created in the middle of a large DNS hierarchy to prevent a query for a distant zone within the same namespace from having to ascend, traverse, and return over a multitude of zones.
Windows Server 2008 also allows for a special type of Primary Zone—known as an AD integrated zone—which basically means that the data is stored within Active Directory Domain Services, and is replicated to other DNS servers during normal AD replication periods. AD-integrated zones offer a number of benefits, including:
• Secure Dynamic. Updates Systems that are authenticated by Active Directory can update their DNS records. This allows name resolution for clients and servers while eliminating DNS poisoning by rogue systems that create DNS records.
• Automatic Synchronization Zones are created and synchronized to new domain controllers (with DNS installed) automatically.
• Efficient Replication Less data is replicated since only relevant changes are propagated.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
• Primary Zone. With a primary zone, the server hosting this zone is authoritative for the domain name. It stores the master copy of the domain information locally. When the zone is created, a file with the suffix .dns is created in the %windir%\System32\dns subdirectory of the DNS server.
• Secondary Zone. This is a secondary source—essentially a copy—of the primary DNS zone, with read-only capabilities.
• Stub Zone. Only stores information about the authoritative name servers for a particular zone.
Primary and secondary zones are standard (that is, non-Active Directory–integrated) forward lookup zones. The principal difference between the two is the ability to add records. A standard primary zone is hosted on the master servers in a zone replication scheme. Primary zones are the only zones that can be edited, whereas secondary zones are read-only and are updated only through zone transfer. DNS master servers replicate a copy of their zones to one or more servers that host secondary zones, thereby providing fault tolerance for your DNS servers. DNS standard zones are the types of zones you should use if you do not plan on integrating Active Directory with your DNS servers.
An Active Directory–integrated zone is basically an enhanced primary DNS zone stored in Active Directory and thus can, unlike all other zone types, use multimaster replication and Active Directory security features. It is an authoritative primary zone in which all of the zone data is stored in Active Directory. As mentioned previously, zone files are not used nor necessary. Integrating DNS with Active Directory produces the following additional benefits:
• Speed. Directory replication is much faster when DNS and Active Directory are integrated. This is because Active Directory replication is performed on a per-property basis, meaning that only changes that apply to particular zones are replicated. Because only the relevant information is to be replicated, the time required to transfer data between zones is greatly reduced. On top of this, a separate DNS replication topology is eliminated because Active Directory replication topology is used for both ADI zones and AD itself.
• Reduced Administrative Overhead. Any time you can reduce the number of management consoles you have to work with, you can reduce the amount of time needed to manage information. Without the advantage of consolidating the management of DNS and Active Directory in the same console, you would have to manage your Active Directory domains and DNS namespaces separately. Moreover, your DNS domain structure mirrors your Active Directory domains. Any deviation between Active Directory and DNS makes management more time-consuming and creates more opportunity for mistakes. As your network continues to grow and become more complex, managing two separate entities becomes more involved. Integrating Active Directory and DNS provides you with the ability to view and manage them as a single entity.
• Automatic Synchronization. When a new domain controller is brought online, networks that have integrated DNS and Active Directory have the advantage of automatic synchronization. Even if a domain controller will not be used to host the DNS service, the ADI zones will still be replicated, synchronized, and stored on the new domain controllers.
• Secure Dynamic. DNS Additional features have been added that enhance the security of secure dynamic updates.
A reverse lookup zone is an authoritative DNS zone that is used primarily to resolve IP addresses to network resource names. This zone type can be primary, secondary or Active Directory–integrated. Reverse lookups traverse the DNS hierarchy in exactly the same way as the more common forward lookups.
Stub zones are a new feature introduced in Windows Server 2008. They contain a partial copy of a zone that can be hosted by a DNS server and used to resolve recursive or iterative queries. A recursive query is a request from a host to a resolver to find data on other name servers. An s query is a request, usually made by a resolver, for any information a server already has in memory for a certain domain name. Stub zones contain the Start of Authority (SOA) resource records of the zone, the DNS resource records that list the zone’s authoritative servers, and the glue address (A) resource records that are required for contacting the zone’s authoritative servers. Stub zones are useful for reducing the number of DNS queries on a network, and consequently the resource consumption on the primary DNS servers for that particular namespace. Basically, stub zones are used to find other zones and can be created in the middle of a large DNS hierarchy to prevent a query for a distant zone within the same namespace from having to ascend, traverse, and return over a multitude of zones.
Windows Server 2008 also allows for a special type of Primary Zone—known as an AD integrated zone—which basically means that the data is stored within Active Directory Domain Services, and is replicated to other DNS servers during normal AD replication periods. AD-integrated zones offer a number of benefits, including:
• Secure Dynamic. Updates Systems that are authenticated by Active Directory can update their DNS records. This allows name resolution for clients and servers while eliminating DNS poisoning by rogue systems that create DNS records.
• Automatic Synchronization Zones are created and synchronized to new domain controllers (with DNS installed) automatically.
• Efficient Replication Less data is replicated since only relevant changes are propagated.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Using Server Core and DNS for Windows Server 2008
One of the ways Server Core can be used is to provide a minimal installation for DNS. A number of advantages to running DNS within Server Core include:
• Smaller Footprint: Reduces the amount of CPU, memory, and hard disk needed.
• More Secure: Fewer components and services running unnecessarily.
• No GUI: No GUI means that users cannot make modifications to the DNS databases (or any other system functions) using common/user-friendly tools.
If you are planning to run DNS within a Server Core install, several steps must be performed prior to installation. The first step is to set the IP information of the server. To configure the IP addressing information of the server, do the following:
1. Identify the network adapter. To do this, in the console window, type netsh interface ipv4 show interfaces and record the number shown under the Idx column.
2. Set the IP address, Subnet Mask, and Default Gateway for the server. To do so, type netsh interface ipv4 set address name=”” source=static address= mask= gateway=. ID represents the interface number from step 1, represents the IP address we will assign, represents the subnet mask, and represents the IP address of the server’s default gateway.
3. Assign the IP address of the DNS server. If this server is part of an Active Directory domain and is replicating Active Directory–integrated zones, we would likely point this server to another AD-integrated DNS server. If it is not, we would point it to another external DNS server—usually the Internet provider of your company. From the console, type netsh interface ipv4 add dnsserver name=”” address= index=1. >. ID represents the number from step 1, while represents the IP address of the DNS server. Once the IP address settings are completed—you can verify this by typing ipconfig /all—we can install the DNS role onto the Core Server installation:
4. To do this, from the command line, type start /w ocsetup DNS-Server-Core-Role.
5. To verify that the DNS Server service is installed and started, type NET START. This will return a list of running services.
6. Use the dnscmd command-line utility to manipulate the DNS settings. For example, you can type dnscmd /enumzones to list the zones hosted on this DNS server.
7. We can also change all of the configuration options we modified in the GUI section earlier by using the dnscmd /config option. For example, we can enable BIND secondaries by typing dnscmd/config /bindsecondaries 1.
There are many, many more things you can do with the dnscmd utility. For more information on the dnscmd syntax, visit http://technet2.microsoft.com/WindowsServer/en/library/d652a163-279f-4047-b3e0-0c468a4d69f31033.mspx.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
• Smaller Footprint: Reduces the amount of CPU, memory, and hard disk needed.
• More Secure: Fewer components and services running unnecessarily.
• No GUI: No GUI means that users cannot make modifications to the DNS databases (or any other system functions) using common/user-friendly tools.
If you are planning to run DNS within a Server Core install, several steps must be performed prior to installation. The first step is to set the IP information of the server. To configure the IP addressing information of the server, do the following:
1. Identify the network adapter. To do this, in the console window, type netsh interface ipv4 show interfaces and record the number shown under the Idx column.
2. Set the IP address, Subnet Mask, and Default Gateway for the server. To do so, type netsh interface ipv4 set address name=”
3. Assign the IP address of the DNS server. If this server is part of an Active Directory domain and is replicating Active Directory–integrated zones, we would likely point this server to another AD-integrated DNS server. If it is not, we would point it to another external DNS server—usually the Internet provider of your company. From the console, type netsh interface ipv4 add dnsserver name=”
4. To do this, from the command line, type start /w ocsetup DNS-Server-Core-Role.
5. To verify that the DNS Server service is installed and started, type NET START. This will return a list of running services.
6. Use the dnscmd command-line utility to manipulate the DNS settings. For example, you can type dnscmd /enumzones to list the zones hosted on this DNS server.
7. We can also change all of the configuration options we modified in the GUI section earlier by using the dnscmd /config option. For example, we can enable BIND secondaries by typing dnscmd
There are many, many more things you can do with the dnscmd utility. For more information on the dnscmd syntax, visit http://technet2.microsoft.com/WindowsServer/en/library/d652a163-279f-4047-b3e0-0c468a4d69f31033.mspx.
Source of Information : Syngress The Best Damn Windows Server 2008 Book Period 2nd Edition
Subscribe to:
Posts (Atom)
Cloud storage is for blocks too, not just files
One of the misconceptions about cloud storage is that it is only useful for storing files. This assumption comes from the popularity of file...
-
Smss is like any other user-mode process except for two differences: First, Windows considers Smss a trusted part of the operating system. S...
-
When Winload calls Ntoskrnl, it passes a data structure called the loader parameter block that contains the system and boot partition paths,...
-
Many of the virus, adware, security, and crash problems with Windows occu when someone installs a driver of dubious origin. The driver suppo...