In
Stubby said:
All:
with Windows 2003 server, is it possible to have this:
blah.ads -> empty root domain
| |
ab.blah.edu cd.blah.edu -> 2 child domains of blah.ads, with
different names
Is this possible when the DNS (BIND) server resides in a blah.edu
zone with all of the records for both ab.blah.edu and cd.blah.edu? I
can't find anything definitive that says child domains can have
different names than the parent in a Windows 2003 AD environment.
Thank you.
Stubb
NO, they cannot be different in the same tree. AD is based on and STRICTLY
follows the DNS hierarchal tree naming convention with a contiguous
namespace.
You can, however, create a separate tree in AD with it's own contigious
namespace. One tree can be blah1.ads, the other tree can be blah2.edu.
Notice I appended a numeral? That is because the default NetBIOS domain name
will follow the highest more portion of the namespace by default. If you
make them blah.ads and blah.edu, the default NetBIOS names are 'blah' and
conlficts WILL ensue. I usually like to follow the defaults because if you
were to change the names, only confusion will set in by your users.
Keep in mind, (with all due respect, I'm sure you already know this, so
please do pardon me if I am redundant or assume otherwise), AD stores it's
service locations and resource records in DNS, hence the complete reliance
on DNS for clients to locate a logon server to authenticate, logon, other
DCs to replicate, etc. Therefore, the DNS naming structure must be strictly
followed for an AD design. Just a note, if one uses an ISP or some other DNS
server that does not host the AD zone name in a client machine, how would
that client find a DC in order for it to logon to a domain? If a DC has an
outside DNS, how would it find either itself or other DCs to replicate to?
If you use BIND, which is no problem whatsover, but it will definitely add
additional administrative overhead, and does not allow only secure updates
with Microsoft products, which is what AD is and the client base is when it
comes to what you are allowing to register. This will eliminate transient
machines from registering into it. TSIGs (BIND's method of secure updates)
are not compatible with Microsoft DNS.
What BIND doesn't offer either is AD Integrated zones. Bind just stores it
in a text file, which is not a secure method of storing the zone. AD
Integrated will store it in the actual physical AD database and replicates
to all DCs in that specific domain (Win2000, but 2003 has more options for
storage). This way all DCs can be DNS servers and there is no need for
Secondaries, since all DCs in that domain will have a copy of the zone in
it;s database and the zone will automatically appear on each DC/DNS in that
domain. Win2003 has options to replicate it forest wide.
Honestly, Microsoft's DNS just works and it has many additional options to
secure it and make it efficiently possible to be on more than one DNS
server. You can always use the BIND server as a forwardee (use it as an
Internet resolver and/or for resources in the schools other parts of the
network) for all the Windows DNS servers. If using BIND is because of a
political reason, I can understand...
As for the original question, may I ask what the purpose and goals are? AD
is pretty flexible to adapt to any business model design, but one needs to
be within its basic restrictions, and that is basically pretty much *only*
based on DNS' hierarchy namespace naming restrictions.
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
If this post is viewed at a non-Microsoft community website, and you were to
respond to it through that community's website, I may not see your reply
unless that website posts replies back to the original Microsoft forum.
Therefore, please direct all replies ONLY to the Microsoft public newsgroup
this thread originated in so all can benefit or ensure the web community
posts it back to the original forum.
Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Infinite Diversities in Infinite Combinations.
=================================
