How to Create a Forward Lookup Zone in w2k3

DNS

This article is a step-by-step guide to creating a Domain Name System (DNS) zone for a new domain.

Note This article does not apply to Active Directory-integrated DNS zones. For additional information about how to setup DNS for Active Directory in Microsoft Windows Server 2003, click the following article numbers to view the articles in the Microsoft Knowledge Base:

816101

(http://support.microsoft.com/kb/816101/ )

HOWTO: Convert DNS Primary Server to Active Directory Integrated

323418

(http://support.microsoft.com/kb/323418/ )

HOW TO: Integrate DNS with an Existing DNS Infrastructure If Active Directory Is Enabled in Windows Server 2003

324753

(http://support.microsoft.com/kb/324753/ )

HOW TO: Create an Active Directory Server in Windows Server 2003

How to Create a Forward Lookup Zone

To create a new forward lookup zone:

1.       Start the DNS snap-in. To do this, click Start, point to Administrative Tools, and then click DNS.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Right-click Forward Lookup Zones, and then click New Zone. The New Zone Wizard starts. Click Next to continue.

4.       Click Primary zone to create a master copy of the new zone. Click Next.

5.       In the Name box, type the name of the zone (for example, type _tcp.example.com, and then click Next.

NOTE: This name is typically the same as the DNS suffix of the host computers for which you want to create the zone.

6.       On the Zone File page, accept the default file name for the new zone file, and then click Next.

7.       Click Next.

8.       Click Finish.

The new zone is listed under Forward Lookup Zones in the DNS tree.

How to Modify the Forward Lookup Zone Properties

To modify or verify the zone properties:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Forward Lookup Zones.

4.       Under Forward Lookup Zones, right-click the zone that you want (for example, example.com), and then click Properties.

5.       In the Allow dynamic updates list, click Yes.

6.       Click the Start of Authority (SOA) tab.

7.       In the Responsible person box, type the e-mail address that you want (in the format of "username.domain.com"). For example, if the e-mail address is support@example.com, type support.example.com.

8.       Click Apply, and then click OK.

How to Create a Reverse Lookup Zone

To create a new reverse lookup zone:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Reverse Lookup Zones.

4.       Right-click Reverse Lookup Zones, and then click New Zone. The New Zone Wizard starts. Click Next to continue.

5.       Click Primary zone, and then click Next.

6.       In the Network ID box, type the network ID. For example, type 192.168.0, and then click Next.

NOTE: The network ID is that portion of the TCP/IP address that pertains to the network. For additional information about TCP/IP networks, click the article number below to view the article in the Microsoft Knowledge Base:

164015

(http://support.microsoft.com/kb/164015/EN-US/ )

Understanding TCP/IP Addressing and Subnetting Basics

7.       On the Zone File page, click Next

8.       Click Next.

9.       Click Finish.

The new zone is listed under Reverse Lookup Zones in the DNS tree.

How to Modify the Reverse Lookup Zone Properties

To modify or verify the zone properties:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Reverse Lookup Zones.

4.       Under Reverse Lookup Zones, right-click the zone that you want (for example, 102.168.0.x Subnet), and then click Properties.

5.       In the Allow dynamic updates list, click Yes.

6.       Click the Start of Authority (SOA) tab.

7.       In the Responsible person box, type the e-mail address that you want (in the format of "username.domain.com"). For example, if the e-mail address is support@example.com, type support.example.com.

8.       Click Apply, and then click OK.

NOTE: When you create the forward and reverse lookup zones, the DNS service automatically creates an "A" record for the DNS server. However, it does not create a PTR record, or reverse lookup record, for the DNS server.

To create a PTR record for the DNS server:

1.       Right-click the reverse lookup zone (for example, 192.168.0.x Subnet), and then click New Pointer (PTR).

2.       In the Host IP number box, type the host portion of the DNS server IP address. For example, if the DNS server is on a "C" class network and has an IP address of 192.168.0.10, the host portion of the IP address is 10. In this case, type 10.

3.       In the Host name box, type the host name of the DNS server. For example, type dnsserv.example.com.

4.       Click OK.

How to Create a Host Record

To create a host or "A" record:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Forward Lookup Zones.

4.       Under Forward Lookup Zones, right-click the zone that you want (for example, example.com), and then click New Host (A).

5.       In the Name (uses parent domain name if blank) box, type the name of the host that you want to add. For example, if you want to add a host record for a Web server, type www.

6.       In the IP address box, type the IP address of the host that you want to add. For example, type 192.168.0.100.

7.       Select the Create associated pointer (PTR) record check box, and then click Add Host. You receive a message similar to the following:

The host record www.example.com was successfully created.

Click OK.

8.       When you are finished adding hosts, click Done.

How to Add a CNAME

A CNAME (or "Canonical Name") is an alias or an additional host name that is resolved to the IP address of an existing host computer in the DNS namespace. For example, if you use the same computer as both a Web server and an FTP server, you may want to resolve both the WWW host name and the FTP host name to the same IP address. Using a CNAME, you can resolve both names to the same IP address.

To create a CNAME:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Forward Lookup Zones.

4.       Under Forward Lookup Zones, right-click the zone that you want (for example, example.com), and then click New Alias (CNAME).

5.       In the Alias name box, type the alias that you want. For example, type ftp.

6.       In the Fully qualified name (FQDN) for target host box, type the fully qualified host name of the host computer that you want. For example, type www.example.com, and then click OK.

How to Add an MX Record

An MX (or "Mail Exchanger") record is used to identify a host computer as a Simple Mail Transport Protocol (SMTP)/Post Office Protocol (POP3) server. To add an MX record, follow these steps. Note that you must first create the "A" record for the mail server host.

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Forward Lookup Zones.

4.       Right-click the zone that you want (for example, example.com), and then click New Mail Exchanger (MX).

5.       In the Fully qualified domain name (FQDN) of mail server box, type the fully qualified domain name of the host computer that acts as the mail server. For example, type mail.example.com.

6.       Click OK.

How to Add a Name Server

To identify an additional name server:

1.       Start the DNS snap-in.

2.       Click the DNS Server object for your server in the left pane of the console, and then expand the server object to expand the tree.

3.       Expand Forward Lookup Zones.

4.       Under Forward Lookup Zones, right-click the zone that you want (for example, example.com), and then click Properties.

5.       Click the Name Servers tab, and then click Add.

6.       In the Server fully qualified domain name (FQDN) box, type the host name of the server that you want to add. For example, type namesvr2.example.com.

7.       In the IP address box, type the IP address of the Name server that you want to add (for example, type 192.168.0.22), and then click Add.

8.       Click OK, and then click OK to return to the DNS window.

9.       Expand Reverse Lookup Zones, right-click the zone that you want, and then click Properties.

10.   Click the Name Servers tab, and then click Add.

11.   In the Server fully qualified domain name (FQDN) box, type the host name of the server that you want to add. For example, type namesvr2.example.com.

12.   In the IP address box, type the IP address of the Name server that you want to add (for example, type 192.168.0.22), and then click Add.

13.   Click OK, and then click OK again to return to the DNS window.

REFERENCES

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

323417

(http://support.microsoft.com/kb/323417/ )

HOW TO: Integrate Windows Server 2003 DNS with an Existing DNS Infrastructure in Windows Server 2003

323380

(http://support.microsoft.com/kb/323380/ )

HOW TO: Configure DNS for Internet Access in Windows Server 2003

For additional information about installing and configuring DNS, click the following article number to view the article in the Microsoft Knowledge Base:

172953

(http://support.microsoft.com/kb/172953/ )

HOWTO: Populate DBGrid from Crosstab Parameter Query

238797

(http://support.microsoft.com/kb/238797/ )

Microsoft DNS Server Installation and Configuration Document Available on Windows NT FTP Site

The Shutdown Event Tracker

Computer shutdowns can be sorted into either of the following categories:

• Expected shutdowns: An expected shutdown can be defined as a computer shutdown which you predict to occur. Expected shutdowns usually occur when one of the following actions are performed:
• Clicking Start, and then the Shutdown command
• Holding down Ctrl + Alt + Del, and then clicking Shutdown

Expected shutdown can be categorized into:

• Planned shutdowns: These are shutdowns which administrators have some form of control over
• Unplanned shutdowns: These are shutdowns normally initiated by applications.

Unexpected shutdowns: Unexpected shutdowns result in the system shutting down without warning, or unexpectedly.

To enable services, programs, and files to close correctly, you should only turn off the computer when the operating system informs you that it is OK to shut down the server. This is extremely important because it ensures that all configuration settings and other important information are saved and written to disk.

Since administrators need to monitor when and why servers are restarted, Windows Server 2003 includes the following tools to control shutdown events:

• Shutdown Event Tracker
• Shutdown.exe

The Shutdown Event Tracker, a new Windows Server 2003 feature, is an uncomplicated GUI application that allows administrators to monitor shutdown events on the server. The tool is enabled on Windows Server 2003 by default. The Shutdown Event Tracker collects information on the reasons why the server was shut down, and then logs this information in Event Viewer. The command-line utility equivalent to the Shutdown Event Tracker is Shutdown.exe.

The Shutdown Event Tracker requires you to provide a reason whenever a server is shut down or restarted. When a server is expectedly shut down, a dialog box or page is displayed, requesting you to specify the reason for the server being shut down. When a server is unexpectedly shut down, the following user to log on to the server has to specify the reason for the server shutting down. Shutdown events can be viewed in Event Viewer, and can be useful when you need to improve uptime.

How to configure the Shutdown Event Tracker

• Not Configured
• Enabled
• Disabled

• Always: This option is self explanatory.
• Server Only: When selected, the Shutdown Event Tracker is displayed for only Windows Server 2003 servers.
• Workstation Only: When selected, the Shutdown Event Tracker is displayed for only Windows XP Professional workstations.

1. Click Start, Run, and then enter gpedit.msc. Click OK.
2. The Group Policy Object Editor console opens.
3. In the left pane, expand Computer Configuration, and then Administrative Templates.
4. Click System
5. In the right pane, find and double-click the Display Shutdown Event Tracker.
6. When the Display Shutdown Event Tracker Properties dialog box opens, select one of the following options:
7. If you select the Enabled option, you can choose between the following options to specify when the Shutdown Event Tracker should be displayed:
8. If you want to view help information on the Shutdown Event Tracker application, click the Explain tab.
9. Click OK, and then close the Group Policy Object Editor console.

How the Shutdown Event Tracker works

• Restart
• Shut down
• Log off the current user

1. Enable the Display Shutdown Event Tracker policy so that the Shutdown Event Tracker is displayed.
2. The Shut Down Windows dialog box is displayed when the server is shut down or restarted. The Shut Down Windows dialog box requires you to record information as to why the server was shut down.
3. Using the options in the What do you want the computer to do drop-down list box, you can choose to perform the following tasks:
4. Using the Options: drop-down list box, select the reason that best describes why the server was shut down or restarted.
5. Next, either select or clear the Planned checkbox to indicate whether the shutdown was planned or unplanned.
6. In the Comment box, enter any additional useful information.
7. Click OK to close the Shut Down Windows dialog box

How to induce the Shutdown Event Tracker functionality on a remote computer

1. To bring up the Remote Shutdown Dialog page on a remote computer, use the shutdown.exe command-line utility with /i.
2. Select the appropriate option from the What do you want the computer to do drop-down list box.
3. In the Shutdown Event Tracker group box, select an option which describes why the computer is being shut down, and click the Planned checkbox.
4. Enter a comment in the Comment box.
5. Click OK.

How to use the shutdown.exe command-line utility

The shutdown.exe command-line utility can be used to enter shutdown events using the command-line. The available options for the shutdown.exe command-line utility are listed below:

• /s ServerName: /s shuts the server down, with ServerName detailing the name of the machine which should be shut down.
• /r: Restarts the shutdown computer.
• /t nnn: Specifies, in seconds, the time period for shutdown. The default is 30 seconds, and can be a value between 0 and 600.
• /d [p:xx:yy]: /d describes the reason for the shutdown; p specifies that the shutdown is planned, xx and yy are for the major and minor reason numbers. The shutdown is regarded as being unplanned when p: is missing.
• /p: Used with the /d switch, it indicates that the power of the machine is on.
• /d[p:]xx:yy: xx (major) and yy (minor) indicate the major and minor reason numbers.
• /m computername: Specifies the name of the target computer.
• /a: Cancels the shutdown

How to use the Registry to configure registry entries for the Shutdown Event Tracker

You can use the Registry Editor to configure the Shutdown Event Tracker. Through configuring registry settings, you can enable or disable the Shutdown Event Tracker.

To configure registry settings for the Shutdown Event Tracker,

1. Click Start, Run, enter regedit, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, and then Reliability.
4. Select ShutdownReasonUI. If ShutdownReasonUI does not exist, create a DWORD value, and then name it ShutdownReasonUI.
5. Enter a data value of 1 in the Value data box to enable the Shutdown Event Tracker, or enter a data value of 0 in the Value data to disable the Shutdown Event Tracker.
6. Click OK.
7. Close the Registry Editor console.
8. Restart the computer.

How to add custom reasons for the Shutdown Event Tracker

• P, indicates a planned shutdown.
• C, a comment is required.
• B, a ID is required.
• S, the expected shutdown event dialog box is displayed
• D, the unexpected shutdown event dialog box is displayed

1. Click Start, Run, regedit enter, and click OK.
2. The Registry Editor console opens.
3. Navigate to HKEY_LOCAL_MACHINE, Software, Microsoft, Windows, CurrentVersion, Reliability, and then UserDefined.
4. Create a new string value using the available flags:
5. You can add additional comments using the string registry value. The format for comments is:
6. Click OK and then close the Registry Editor console.
7. Restart the computer.

How to view shutdown events

Shutdown events can be viewed in Event Viewer. Event Viewer is used to monitor events that took place on a computer. Event Viewer stores events that are logged in a system log, application log, and security log. Because the system log conains events that are associated with the operating system, shutdown events are written to the system log.

To open Event Viewer,

1. Select Start, Select Administrative Tools, and then select Event Viewer.
2. Select the event log you want to view.

Event Viewer logs list five event types:

• Information events tell you when a particular activity occurs, such as starting the system.
• Warning events point out problems that could possibly occur.
• Error events indicate an actual error that occurred.
• Success Audit events indicates an event that has been audited for success
• Success Failure events indicates an event that has been audited for failure

To view shutdown events

1. Open Event Viewer
2. Open the System log.
3. Using the Event Source drop-down list, select USER32.
4. To view the System log in a form, filtered to show only shutdown events and USER32 events, click OK.
5. When the events are displayed, you can examine a detailed description of a particular shutdown event by double-clicking the particular event.
6. The Event Properties dialog box is displayed.
7. Click OK to close the dialog box.

How to disable the Shutdown Event Tracker

1. Click Start, Run, and then enter gpedit.msc. Click OK.
2. The Group Policy Object Editor console opens.
3. In the left pane, expand Computer Configuration, and then Administrative Templates.
4. Click System
5. In the right pane, find and double-click the Display Shutdown Event Tracker.
6. When the Display Shutdown Event Tracker Properties dialog box opens, click the Disabled option to disable the Shutdown Event Tracker.
7. Click OK.
8. Close the Group Policy Editor console.

How to Delegate Administrator Privileges in Active Directory

The primary reason to create organizational units is to distribute administrative tasks across the organization by delegating administrative control to other administrators. Delegation is especially important when a decentralized administrative model is developed. Delegation of administration is the process of decentralizing the responsibility for managing organizational units from a central administrator to other administrators. The ability to establish access to individual organizational units is an important security feature in Active Directory. Users can control access to the lowest level of an organization without having to create many active directory domains.

Authority delegated at the site level will likely span domains or conversely, may not include targets in the domain. Authority delegated at the domain level will affect all objects in the domain. Authority delegated at the organizational unit level can affect that object and all of its child objects or just the object itself.

Delegation of control is the ability to assign the responsibility of managing Active Directory objects to another user, group, or organization. By delegating control, the need for multiple administrative accounts that have broad authority can be eliminated. Delegated administration in Active Directory helps ease the administrative burden of managing a network by distributing routine administrative tasks to multiple users. Basic delegated rights can be given to normal users, like create a user account or group account etc. and major domain-wide administration work can be delegated to senior/junior level administrator.

Autonomy is the ability of administrators in an organization to independently manage:

• All or part of service management (called service autonomy).
• All or part of the data in the active directory database or member computers that are joined to the directory (called autonomy).

Common Administrative Tasks

Administrators routinely perform the following tasks in active directory:

• Change properties on a particular container. For example, when a new software package is available, administrators may create a group policy that controls software distribution.
• Create and Delete objects of a specific type. In an organizational unit, specific types may include users, groups, and printers. When the new employee joins the organization, for example, a user account is created for the employee and then the employee is added to the appropriate organizational unit or group.
• Update specific properties on specific object types. In an organizational unit, this is perhaps the most common administrative task performed. Updating properties include tasks such as resetting passwords and changing an employee’s personal information, such as his/her home address and phone number, when he/she moves.

Delegation of Administrative Control

Use the delegation of control wizard to delegate administrative control of active directory objects such as organizational units. By using the wizard, users can delegate common administrative tasks such as creating, deleting, and managing user accounts.

To delegate common administrative tasks for an organizational unit, perform the following steps:

• Start the delegation of control wizard by performing the following steps:
  • Open Active Directory Users and Computers.
  • In the console tree, double click the domain node.
  • In the details menu, right click the organizational unit, click delegate control, and click next.
• Select the users or group to which common administrative tasks will be delegated. To do so, perform the following steps:
  • On the Users or Groups page, click Add.
  • In the select Users, computers, or Groups, write the names of the users and groups to which control of the organizational unit has to be delegated, click OK and next.
• Assign common tasks to delegate. To do so, perform the following common tasks:
  • On the tasks to delegate page, click delegate the following common tasks.
  • On the tasks to delegate page, select the tasks to be delegated and click OK.
• Click Finish.

Customizing Delegated Administrative Control

In addition to using the delegation of control wizard to delegate a custom set of administrative tasks such as the creation, deletion, and management of user accounts, use the wizard to select a set of custom tasks and delegate control of only those tasks.

For example, users can delegate control of all existing objects in an organizational unit and any new objects that are added or select the objects in the organizational unit to delegate administrative control of, such as only user objects in an organizational unit. Users can also specify that they want to delegate only the creation of the selected objects, the deletion of the object, or both.

To delegate custom administrative tasks for an organizational unit, perform the following steps:

• Start the Delegation of Control Wizard.
• Select the users or groups to which administrative tasks will be delegated.
• Assign the custom tasks to delegate. To do this, perform the following steps:
  • On the Tasks to Delegate page, click Create a custom task to delegate and click next.
  • On the Active Directory Object Type page, select one of the following tasks:
• Click This folder, existing objects in this folder, creation of new objects in this folder, and click next.
• Click Only the following objects in the folder, select the Active Directory object type that will delegate control, and click next.
  • Select the permissions to be delegated and click next.
• Click Finish.

Replication Topology in Active Directory

Replication Topology is the route by which replication data travels throughout a network. Replication occurs between two domain controllers at a time. Over time, replication synchronizes information in Active Directory for an entire forest of domain controllers. To create a replication topology active directory must determine which domain controller's replicate data with other domain controllers.

The Knowledge Consistency Checker (KCC) is a built-in process that runs on each domain controller and regenerates the replication topology for all directory partitions that are contained on that domain controller. The KCC runs at specified intervals of every 15 minutes by default and designates replication routes between domain controllers that are most favorable connections that are available at the time.

How the KCC Works

To generate a replication topology automatically, the KCC evaluates information in the configuration partition on sites, the cost sending data between these sites (cost refers to the relative value of the replication paths), any existing connection objects, and the replication protocols that the KCC can domain controller's directory partitions to other domain controllers. If replication within the site becomes impossible or has a single point of failure, the KCC automatically established new connection objects between domain controllers to domain Active Directory replication.

Global Catalog and Replication of Partitions

A global catalog server is a domain controller that stores two forest-wide partitions-the schema and configuration partitions plus a read/write copy of the partition from its own domain and a partial replica of all domain partition in the forest. These partial replicas contain a read only subset of the information in each domain partition.

When you add a new domain to a forest, the configuration partition also adds the same information about the new domain. Active Directory replicates the configuration partition to all domain controllers, including global catalog servers, though normal forest-wide replication. Each global catalog server becomes a partial replica of the new domain by contacting a domain controller for that domain and obtaining the partial replica information. The configuration partners also provide the domain controllers a list of all global catalog servers in the forest.

Global Catalog servers register special DNS records in the DNS zone that corresponds to the forest not domain. These records, which are registered only in the forest root DNS zone, helps client and servers locate global catalog servers though out the forest.

Sites and Site Links

In Active Directory, sites help define the physical structure of a network. A set of TCP/IP subset address ranges defines a site, which in turn defines a group of domain controllers that have similar speed and cost. Sites consist of server objects, which contain connection objects that enable replication.

When you create additional sites, you must select at least one site link for each site, unless a site link is in place, connections cannot be made between computers at different sites, nor can replication occur between sites. Additional site links are not created automatically; you must use active directory sites and services to create them.

When you create the first domain in a forest, active directory creates a default site link named DEFAULTSITELINK. It indicates the first site and is located in the IP container in active directory. You can rename the site link.

To use sites to manage replication between sites, you create additional sites and subnets and delegate control of sites. Creating a site involves providing a name for the new site and associating the site with a site link. To create sites, you must log on as a member of the Enterprise Admin group or the Domain Admin group in the forest root domain.

A site link bridge creates a chain of site links that domain controllers from ifferent sites in the site links can use to communicate directly. Bridging is useful to constrain the KCC to particular paths in the site link topology. By default, site link bridging is enabled and all site links are considered transitive. That is, all site links for a given transport implicitly belong to a single site link bridge for that transport. So, in a fully routed IP network, it is not necessary to configure any site link bridges. If your IP network is not fully routed, you can disable site link bridging to urn off the transitive site link feature for the IP transport, and then configure site link bridges to model the actual routing behavior of your network.

The Bridgehead server is a domain controller that you designed to send and receive replicated data at each site. The bridgehead server from the originating site collects all of the replication changes and then sends them to the receiving site's bridgehead server, which replicates the changes to all domain controllers in the site.

Intersite Topology Generator

The inter site topology generator in an active directory process that defines the replication between the sites on a network. A single domain controller in each site I automatically designated to be the inter-site topology generator. Because this action is performed by the inter-site topology, you are not required to take any action to determine the replication topology and the bridgehead server roles.

The domain controller that holds the inter-site topology generator role performs two functions:

• It automatically selects one or more domain controllers to become bridgehead servers. This way, if a bridgehead server becomes unavailable, it automatically selects another bridgehead server, if possible.
• It runs the KCC to determine the replication topology and resultant connection objects that the bridgehead servers can use to use to communicate with bridgehead server of other sites.

To refresh replication topology, first determine whether you want to refresh the replication topology between sites or the replication topology within a site