Share via

Understanding Active Directory Domain Services Integration

  • Article

Applies To: Windows Server 2008, Windows Server 2008 R2

The DNS Server service is integrated into the design and implementation of Active Directory Domain Services (AD DS). AD DS provides an enterprise-level tool for organizing, managing, and locating resources in a network.

When you deploy Domain Name System (DNS) servers with AD DS, consider the following:

  • DNS is required for locating domain controllers.

    The Net Logon service uses DNS server support to provide registration of domain controllers in your DNS domain namespace.

  • DNS servers running Windows Server 2003 or Windows Server 2008 can use AD DS for storing and replicating your zones.

    By integrating your zones with AD DS, you can take advantage of DNS features, such as AD DS replication, secure dynamic updates, and record aging and scavenging.

How DNS integrates with AD DS

When you install AD DS on a server, you promote the server to the role of a domain controller for a specified domain. As part of this process, you are prompted to specify a DNS domain name for the AD DS domain which you are joining and for which you are promoting the server, and you are offered the option to install the DNS Server role. This option is provided because a DNS server is required to locate this server or other domain controllers for members of an AD DS domain.

Benefits of AD DS integration

For networks that deploy DNS to support AD DS, directory-integrated primary zones are strongly recommended. They provide the following benefits:

  • DNS features multimaster data replication and enhanced security based on the capabilities of AD DS.

    In a standard zone storage model, DNS updates are conducted based on a single-master update model. In this model, a single authoritative DNS server for a zone is designated as the primary source for the zone. This server maintains the master copy of the zone in a local file. With this model, the primary server for the zone represents a single fixed point of failure. If this server is not available, update requests from DNS clients are not processed for the zone.

    With directory-integrated storage, dynamic updates to DNS are sent to any AD DS-integrated DNS server and are replicated to all other AD DS-integrated DNS servers by means of AD DS replication. In this model, any AD DS-integrated DNS servercan accept dynamic updates for the zone. Because the master copy of the zone is maintained in the AD DS database, which is fully replicated to all domain controllers, the zone can be updated by the DNS servers operating at any domain controller for the domain. With the multimaster update model of AD DS, any of the primary servers for the directory-integrated zone can process requests from DNS clients to update the zone as long as a domain controller is available and reachable on the network.

    Also, when you use directory-integrated zones, you can use access control list (ACL) editing to secure a dnsZone object container in the directory tree. This feature provides detailed access to either the zone or a specified resource record in the zone. For example, an ACL for a zone resource record can be restricted so that dynamic updates are allowed only for a specified client computer or a secure group, such as a domain administrators group. This security feature is not available with standard primary zones.

  • Zones are replicated and synchronized to new domain controllers automatically whenever a new one is added to an AD DS domain.

    Although the DNS Server service can be selectively removed from a domain controller, directory-integrated zones are already stored at each domain controller. Therefore, zone storage and management is not an additional resource. Also, the methods that are used to synchronize directory-stored information offer performance improvement over standard zone update methods, which can potentially require transfer of the entire zone.

  • By integrating storage of your DNS zone databases in AD DS, you can streamline database replication planning for your network.

    When your DNS namespace and AD DS domains are stored and replicated separately, you must plan and potentially administer each of these items separately. For example, when you use standard DNS zone storage and AD DS together, you have to design, implement, test, and maintain two different database replication topologies.

    For example, one replication topology is needed for replicating directory data between domain controllers, and another topology is needed for replicating zone databases between DNS servers. This can create additional administrative complexity for planning and designing your network and allowing for its eventual growth. By integrating DNS storage, you unify storage management and replication issues for both DNS and AD DS, merging and viewing them together as a single administrative entity.

  • Directory-integrated replication is faster and more efficient than standard DNS replication.

    Because AD DS replication processing is performed on a per-property basis, only relevant changes are propagated. Less data is used and submitted in updates for directory-stored zones.

Only primary zones can be stored in the directory. A DNS server cannot store secondary zones in the directory. It must store them in standard text files. The multimaster replication model of AD DS removes the need for secondary zones when all zones are stored in AD DS.

For more information about configuring DNS for AD DS integration, see Configure a DNS Server for Use with Active Directory Domain Services and Checklist: Add a Domain Controller with the DNS Server Service.