Home / server / Questions / 291953
Accepted
Mutahir
Asked: 2011-07-20 10:38:57 +0800 CST

AD Topology - One Forest 3 Domains

  • 772

We have AD on 2008R2 implemented and working fine. We have ONE Forest and 3 child domains city1.domain.lan, city2.domain.lan, city3.domain.lan with rootdc.domain.lan being the forest master. Forest functional level is Windows 2003.

I have recently inheritted this setup and my initial findings reveal that the child domains are not resolving DNS name lookups for external requests, rather the previous sys-admin was distributing DC IPADDRESS, 8.8.8.8 and 4.2.2.2 as DNS servers.

There are no forwarders configured on the DC DNS MMC, moreover the DC cannot browse the internet due to security reasons, they have a VPN tunnel connected to root site for replication but all other traffic is disabled on that circuit - so no internet connectivity for the DC itself - hence no external DNS lookups.

As they have around 500 - 700 Users and considering everyone is getting 8.8.8.8 and 4.2.2.2 for external dns lookups, I am thinking that would be a lot of requests going out there Internet Link for DNS (53).

Q1 - Do you think I should implement a windows based DC joined to the child domain for external look ups or the above setup seems ok?
Q2 - What do I look for to verify whether the DC is replicating fine (repadmin ?)
Q3 - I checked Sites and Services but I am not very good in AD and have to learn - so would be grateful if you could let me know what to look for ?
Q4 - I used AD topology diagrammer and it says Intersite Replication disabled ? Is this harmful ?

I will post more details about the AD topology and if one could let me know what to provide as info - I will do my best to get the question updated ASAP

Your help would be grately appreciated
Thanks !!

windows active-directory windows-server-2008-r2

1 Answers

  1. Best Answer

    Q1 - My suggestion would be to setup caching DNS servers (Windows or bind) that is used ONLY for external lookups in your DMZ so your setup would look like:

    Client -> DC -> DNS server in DMZ -> interwebs

    Q2 - Check out dcdiag, also the DC event logs and DFS event logs

    Q3 - Not sure what you are asking here

    Q4 - yes, if your domains arn't replicating between sites then you can and will have conflicts. However, if you only have one site ... well then it's not a problem.

    • 2