Windows Forum

Ask something
Discussion Locked

Altering Primary DNS Suffix

0 helpful
3 replies

by Member 34685496

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
When our office domain was upgraded from NT4.0, the domain admin at the time had appended all computers in the domain (including servers & DC's) with a primary DNS suffix different from our domain name. To further complicate it, the Primary DNS suffix is the name of our web presence. For example, OFFICE & OFFICESOURCE would be the two domains, with OFFICE being the internal and OFFICESOURCE being the external. Fully Qualified Domain Names of all computers, including DC's, in the OFFICE domain appear as COMPUTERNAME.OFFICESOURCE.COM. How can I: 1)change the primary DNS suffix of a DC without demoting/promoting it? 2)Change the DNS zone name to match the new primary DNS suffix? 3)Change the ADUC name to match the new primary DNS suffix? 4)Do all of the above without risking loss of access to resources? This issue is standing in the way of further upgrades, and it's getting bigger by the day! Thanks in advance for any help!

3 replies

by cg it

hummm the FQDN is one you get from a domain registrar with the .com .net .org .gov .tv and so on extension. your internal DNS can be the same as your FQDN though industry experts in security recommend you make it different than your FQDN. Therefore when you upgraded from NT4.0 to W2K or W2003 server and it has a different suffix isn't a bad thing. It seperates your LAN from public view.

so from the information you have given, this is the configuration of your DNS. You have a public FQDN that is different than your private name, good for security. If the problem is that clients on the LAN cannot find the DC for authentication, then create the A records and ptr records that will point clients to the DC and resolve ip to name for them to log on and authenticate.

You did not mention if your network is AD intergrated or not. Would be helpful to know.

by cg it

theres an article on Microsofts Help & Support which should help you. # 237675 Setting up the Domain Name System for Active Directory. In short, use the MMC DNS snap in to manage your DNS. Its a matter of changing the DNS records [which can be a bit frustrating if a "ooops damn it" happens].

by Member 34685496

It is AD integrated. I agree that separation of namespace is a good thing, and that's what I'm trying to accomplish. As it currently stands, it's difficult to know which domain you're looking at, since both end with OFFICESOURCE.COM.

This discussion is closed to new replies.