Windows Forum

Ask something
Discussion Locked

DNS and Group Policies

0 helpful
5 replies

by eporteni

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Windows 2000 DC running both DHCP and DNS for my network. I also have about 30 XP machines that NEED to have group policies enforced on them. Here is what has been happening. On the XP clients, the group policy will not apply itself. I had thought that maybe it was because the domain policy was propegating down and overriding the OU policy, so I checkemarked the "no override" button, but to no avail. So, by just playing around a bit, I went into my network connection settings, into the TCPIP settings, and instead of assiging an IP AND DNS server automatically, I only had it assign the IP, and I typed in the IP address of my domain controller, which is also acting as my DNS server. This worked to apply the group policy, but now my internet access is gone from those XP client machines. But when I take out the DNS IP, I get internet, but no policy. Is there a setting in my DNS configuration that I am missing? I have both a "." DNS zone and my "prep" zone... is this what is causing my problems? I have paused the "." zone and tried applying the "prep" zone settings to the DNS settings on the xp clients, but that is not working. I have only just added the dns suffix to be "prep" on the clients... this does not seem to be working though. It is quite important that I get this working very soon, so any help that anyone can provide would be GREATLY appreciated.
THank you!
If you have any specifics, please email me at eporteni@cathedral-prep.com

5 replies

by cg it

This problem sounds more like a DNS problem and authentication problem with clients than a GP problem.

what GP are you linking to the OU? the default computer, default user or a GP you created for a user or computer?

by timwalsh

Here is what I think is happening:

By setting up your DNS server as a "root" server (you have a "." zone), you have essentially told your DNS server that it is authoritataive for ALL DNS queries in your domain. Therefore, it isn't forwarding DNS queries it can't resolve (i.e. Internet queries) to outside DNS servers that could resolve the query.

It sounds like when your workstations get DNS info via DHCP, they are referred to DNS servers outside your organization. That's why they can access the Internet at that point but not when you point them to your DNS server. AD-enabled workstations require DNS in order to be able to determine where the DC is. If they are being pointed to a DNS sewrver outside the organization, they aren't getting the required AD-related DNS info.

The proper way to resolve your problem is as follows:

1. Delete the "." DNS zone.
2. Point your DNS server to itself for DNS resolution.
3. Configure the Forwarders section of your DNS configuration to point to your ISP's DNS server.
4. All workstations should point to your internal DNS server ONLY (either hard-coded or distributed through DHCP).

The effect is as follows:
All DNS queries related to your domain resources are resolved by your DNS server. All queries related to resources outside your domain (i.e. the Internet) are automatically forwarded to the DNS servers specified in the Forwarders section for resolution.

BTW, a domain policy will never override an OU policy (because the OU policy is applied last) unless the "no override" switch is set on the domain policy.

Hope this helps.

by eporteni

MOst of this is going okay, and I totally appreciate all of your answers. As for my other comment, if anyone has any other ideas I can try, PLEASE contact me. Thanks a lot!

by eporteni

This seems to be on the right track, but I have run into the situation where I have put the ISP's DNS IPs in the forwarder area, but even when the client is pointed to the internal DNS, it is applying the GPO, but not allowing any outside internet traffic. I CAN put the external DNS IPs on the client and it will work both ways, applying the GPO and allowing outside traffic, but I REALLY don't want to do this with the external DNS addresses. Now I do also have an ISA firewall... could this also be causing a problem with the DNS? Thanks very much for all your answers and help... like I said, I do appreciate it!

This discussion is closed to new replies.