Hey guys. I'm working with the following scenario. There are 3 servers in this domain.
- 1 runs Win2003 and is the current name server and DHCP server, joined to the domain.
- 1 runs Win2003 and is a secondary DC
- 1 runs Win2008 and is the primary DC.
The domain currently has about 10 clients that run on DHCP and 30 on static. I want to transfer the DNS role over to the two DCs.
What is the best way to do this to make sure that the DHCP clients register their records with the DCs? I also want the records to update on both DCs so that if one of them goes down, the clients are still able to resolve queries and get on the internet.
To achieve the fault tolerance you're looking for you want an Active Directory Integrated DNS zone being hosted by both domain controllers. Each DC will be configured to use itself and the other DC as a DNS server.
Microsoft can give you some deeper background on how DHCP and DNS work together for dynamic updates. I'll give you a high-level view here.
To allow domain-joined client computers to register with DNS you'll configure the DNS zones to allow secure dynamic updates. (If you have clients that aren't domain-joined and you want them to perform dynamic updates then you won't be able to use secure updates or you'll have to hack together a solution. I'm going to set this scenario aside as out-of-scope for this answer unless you tell me otherwise.)
Your DHCP scope options should be altered to give the clients both DC IP addresses as DNS servers. Personally, I'd look at migrating those devices with static IP addresses to DHCP reservations such that future changes to DNS server addresses (gateway addresses, etc) don't require manual changes on each host. Even if you can't actually use the DHCP reservations (because the device with the static must actually have a static IP for some reason) you should still use DHCP reservations to track your IP address assignment. It gives you a One True IP Address ListTM and doesn't fall out of date like bogus spreadsheet-based "solutions" do because the operational database is the reference source, too.
If your DHCP server is going to perform proxy name registrations for clients then you'll want to create a user account specifically for the purposes of being used as the security context to register DNS records by the DHCP server. You can see more more detail from Microsoft on this point.
To allow clients to resolve Internet names through the DNS servers running on the DCs either leave the default "root hints" installed or configure the DCs with "Forwarders" to DNS servers at your ISP (or OpenDNS, Google DNS, etc).
As far as the "nuts and bolts" of this go:
Install the DNS Server role onto both domain controller computers. Since your current DNS server isn't a domain controller the forward lookup zones for your domain have to be stored in standard primary DNS zones.
If you don't care about the records in the DNS right now then simply add the forward lookup zones for "yourdomain.com" and "_msdcs.yourdomain.com" to the DNS servers running on your DC's, set them to use themselves and the other DC as their DNS servers, run an "ipconfig /registerdns" and restart the "Netlogon" service and they will register the necessary records into DNS for themselves. After that, your clients can update their own records and your DNS zone will re-poulate. Be sure to do your reverse lookup zones, too.
Assuming you do want to retain the data in your current DNS zones the easiest way to migrate them into Active Directory would be to promote the current DNS server to being a domain controller (so long as you don't have any local user accounts on the machine to worry about), change the zone type to "Active Directory Integrated" on each zone, and to allow Active Directory to replicate. After you've done this you'll see your zones (both forward and reverse) become available on the DNS servers running on the DCs (after replication completes. Either force replication or be patient).
Once the zones are replicated into AD you can demote the current DNS server machine back to being a member server.
You should mark both DCs as "Global Catalog" servers to allow for redundant access to the global catalog when you're rebooting one of the DCs. This goes hand-in-hand with having DNS redundancy.
If you're prefer not to promote / demote the current DNS server but still want to preserve the data currently in your DNS zones you could get familiar with the DNSCMD tool, which you can use to perform command-line manipulation of DNS zones. You can also hack around with standard primary zones at the level of the zone data files making it possible to copy the contents of your current standard primary zone over to a DNS server running on one of the DCs via file copying. (I'm not sure such hackery is "supported" by Microsoft so you're likely on your own w/ anything like that.)
You should also configure aging and scavenging on your DNS zones. This allows old, out-of-date mappings that might've been dynamically registered to be deleted from the DNS zones automatically.
As an aside: There are no "primary" and "secondary" domain controllers in an Active Directory domain. There 2 forest-wide and 3 domain-wide "flexible single-master roles" that are delegated to individual domain controllers (including one called "Primary Domain Controller Emulator") but no single DC is the "primary" DC. Clients will authenticate to either one (by default) and treat them as equal copies.
Install DNS server role on both DC's, 1 at at time and let the 1st complete before starting the 2nd.
Set as AD integrated.
On each DC, in the NIC, tcp/ip properties, set each DC to look to itself for DNS first and the other DNS server second. (Some will say the order should be reversed but the principle is the same, each server should have 2 DNS options.)
Run ipconfig /registerDNS on the DC's.
Configure the DCHP server scope:
Depending on why the clients are statics, you can also enter the 30 statics as lease reservations w/ the MAC address and change them over to DHCP. Remember to backup the DHCP config if this is configured.
Change the DNS settings on this server to look to the new server. Remove the DNS server role on the current server.