Rogue DNS "A" and "SRV" records

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a very interesting problem regarding our DNS service... A little background; it is a primary dns zone that is authoritative for our W2K domain...all dns updates are done via dhcp dynamic updates.

Here is the problem, occaisionally you can do a nslookup on our domain (marshall.edu) and it will return our domain controllers of course, but sometimes it will include just a regular Windows XP machine. I go to DNS snap-in and load the zone to find the "A" record referring to some lab machine as "Same as Parent Folder". If I look a little deeper I find that the machine in question also has "SVC" records identifying it as a LDAP server. Even WINS is identifying some of the machines as Domain Controllers. After close inspection of the machines that these records were referring to, I noticed nothing odd about them.
 
The "SVC" records are SRV records ?
Is your DNS zone set to allow only secure updates ?

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Jaymz said:
I have a very interesting problem regarding our DNS service... A little
Click to expand...
background; it is a primary dns zone that is authoritative for our W2K
domain...all dns updates are done via dhcp dynamic updates.
Here is the problem, occaisionally you can do a nslookup on our domain
Click to expand...
(marshall.edu) and it will return our domain controllers of course, but
sometimes it will include just a regular Windows XP machine. I go to DNS
snap-in and load the zone to find the "A" record referring to some lab
machine as "Same as Parent Folder". If I look a little deeper I find that
the machine in question also has "SVC" records identifying it as a LDAP
server. Even WINS is identifying some of the machines as Domain Controllers.
After close inspection of the machines that these records were referring to,
I noticed nothing odd about them.
 
In
Jaymz said:
I have a very interesting problem regarding our DNS service... A
little background; it is a primary dns zone that is authoritative for
our W2K domain...all dns updates are done via dhcp dynamic updates.

Here is the problem, occaisionally you can do a nslookup on our
domain (marshall.edu) and it will return our domain controllers of
course, but sometimes it will include just a regular Windows XP
machine. I go to DNS snap-in and load the zone to find the "A" record
referring to some lab machine as "Same as Parent Folder". If I look a
little deeper I find that the machine in question also has "SVC"
records identifying it as a LDAP server. Even WINS is identifying
some of the machines as Domain Controllers. After close inspection
of the machines that these records were referring to, I noticed
nothing odd about them.
Click to expand...

In addition to Roger and Jonathan's response, try enabling Scanvenging to
remove stale (old) records.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top