Tedwin's questions

Four-site company using Windows Domain and DNS servers. Minimum of one DC/DNS server per site. One site is HQ and hosts most companywide servers and services. DNS records for Windows servers are allowed to register instead of static.

Critical servers are replicated hourly to datacenter failover (fifth site) site using Veeam. When testing failover we are noticing longer than ideal wait times for DNS records to resolve to "new" datacenter IPs if no flush is performed. Please note there's a DC running in the DC environment always.

To allow for quicker updates in the case of a failover, I have changed TTLs for A records for the replicated servers from the default of 20 minutes to 10. When researching SOA record TTL settings I am becoming confused. Does the SOA "Minimum (default) TTL" (image below) control how long clients will cache bad or unreachable records? What is the difference between "Minimum (default) TTL" and "TTL for this record"?

I'd like to transfer DNS records from Network Solutions to DNS Made Easy, mainly to take advantage of "DNS Failover" provided by DNS Made Easy to automatically fail a couple of key A records over to new IPs in my data center where I replicate servers to for DR if DNS Made Easy senses that the primary IP on prem is unavailable.

This guide is helpful, but I don't understand the first step regarding TTLs. My understanding of TTLs has always been that hosts cache records for an amount of time as told by the TTL when querying records. If that understanding is correct, how can I have any control over expiration?

My plan is to:

1. Create new zone files on new DNS provider at my leisure
2. Change existing nameservers at the registrar to the new DNS Made Easy nameservers at night, cross my fingers and wait for morning

What can I do in relation to the TTLs to improve my chances of making this seamless?

Five-site company connected with low-latency layer 2 or IPSec tunnels, 2 DCs at each site.

I have noticed that browsing to \\domain.tld often displays sysvol/netlogon shares from a remote DC. The reason I can tell is because a couple of the smaller sites have DCs that also run print management; the printer shares are displayed there as well.

Pinging domain.tld from a desktop at the HQ site often resolves to a remote DC's IP address. ipconfig /flushdns then pinging domain.tld again always seems to cause the workstation to resolve the domain name to a different DC, often one at the local site.

To be clear, this isn't causing a problem that I know of, I'm just trying to understand why DNS is behaving this way. %logonserver% seems to always resolve to a local DC regardless of which DC returns my pings for domain.tld.

Latency between sites is sub-10ms and bandwidth is > 50 Mbps synchronous.

Thanks very much for reading!

UPDATE: Round Robin is enabled for each DNS server under DNS -> (right click DNS server name) -> Properties -> Advanced -> "Enable round robin." In addition, in DNS - > (server name) -> Fwd Lookup Zone -> domain.tld, I see name server entries ("same as parent folder") for each domain controller in the forest. There are also A record with name "(same as parent folder)" for each DC. I am thinking this behavior is expected, can anyone verify my assumption is correct?

I'm new to failover clustering and looking for verification that my oversimplified steps below are appropriate as a starting point. I have two Dell R430s (Windows Server 2012 R2 Enterprise) that will serve as Node0 and Node1. The SAN is a Dell MD3420.

1. For the private heartbeat network I'll use a short crossover cable to directly connect NIC0 to NIC0 on the two nodes.
2. I'll Connect NIC1 on each respective node to my switch(es.) In reality I'll use LACP to team a couple NICs on each node.
3. Using the Dell SAN Management tool I'll create two logical volumes - one at 1024 mb for the quorum and one much larger volume for shared storage for my VMs.
4. I'll add the shared volumes to each node - not sure exactly how to do this but will review the Dell whitepaper as I go through the steps.
5. Add the Failover Clustering role to each node. Run verification tool on one.
6. Add the Hyper-V role within the Failover Cluster Management tool on one of my nodes.
7. Test and once everything looks good, migrate my existing VMs from four standalone servers with local storage to either of my two nodes.

I want to use the nodes in an active configuration. In other words, I want to utilize both nodes equally which ensuring a VM from either node will fail over to the other node if there's a problem.

Again, I know this is a massive oversimplification but am I missing any "major" steps in the process? Thanks very much for reading.

HP Proliant dl360 g7. Two Broadcom NICs teamed LACP using Windows Server 2012 built-in teaming utility. BIOS setting to "enable WOL" is set to enabled. No "Power Management" tab exists in the (virtual) team adapter!

Machine will not wake when magic packet is forwarded to the MAC address of the team. Am I missing something? Is it possible to wake a NIC team?

I want to install a dual- or quad-port gigabit NIC card in a Dell riser card. The full-height slot is already populated with a Dell SAS HBA (green card in the photo.) Can I use the other side of the riser card for a half-height NIC?

The reason I'm asking is because the riser card uses the same PCI slot on the system board for both the slots on the riser card. It doesn't seem like both the HBA and an additional NIC could make use of this single PCI slot. Hardware needs to be purchased yet so I'm trying to make sure it will work before I buy.

Dell documentation is not specific.

Thanks for your help.

Suddenly several domain computers running Windows 7 and at least one server on 2008 R2 are thinking that their NIC is part of a "public" network. The weird part is that when this symptom occurs the domain machines are not able to access the internet in any way and nothing is able to access them.

Pinging any LAN resource succeeds but pinging any public address (ie 8.8.8.8) fails with General Failure error.

As soon as the "network location" is reset to private or work or whatever, everything works normally again.

Any ideas as to what might cause this? It's a nightmare to change by hand.

Lastly, a "colleague" recently accessed this network and I have reason to believe he may have changed some thing or some number of things that may have caused this. What might he have done?

When leveraging User Configuration -> Policies -> Software Settings -> Software Installation to publish particular packages for domain users to install at their own will, how can one handle software which requires a serial number/activation code to activate?

An example might be Adobe Acrobat Pro or even Microsoft's own Office suite. Traditionally I have copied and pasted the serial/code from a text file I keep somewhere on the network in order to activate. Is there a way to slipstream the code into the installer or something like that?

Thanks.

I'm struggling to remove the "Upgrade to Windows 10" Notification Area Icon on a bunch of Win 7 Pro machines on a 2008 R2 domain. No WSUS server.

I've tried enabling "Turn off the upgrade to the latest version..." setting in my domain's Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update, then gpupdating on my own PC to test. Restart. Update gp again. Restart. The icon is still there.

I need to install WSUS - it's a rainy day project that I've been planning on for a while. But it's sunny right now and I have more important shit to triage.

Any ideas? Thanks!

Edit: this question is not a duplicate, because these hosts are all part of a domain. It's fundamentally a very different situation.

I'm looking for a GP-style fix; registry hacks one at a time on individuals' PCs are not something I have time to do.

Server is connected two two separate, isolated subnets via two physical nics. Is there any way the server can act as a gateway for the two networks to communicate? To clarify, I don't want any communication. The goal is just to provide the same web services to both subnets from the server only, without allowing it to connect the two in any way.

Network A is a typical office LAN. Network B is in the same building but isolated. No internet access, nothing. It needs to remain that way for a variety of proprietary reasons. Users developing software must upload it to a subversion server via N A. Technicians on N B must be able to access the subversion files. My switches on both subnets are Procurve 2810 ...no ACL support I don't think.