2

We have an AD environment all linked together to domain controllers in a datacentre via ipsec tunnels - the DNS appears to work perfectly, they're all set to 127.0.0.1 with forwarding addresses and each DHCP server giving out the correct address. All the subnets are also set up in sites and services correctly and we've encountered no problems with DNS (yet).

However, whenever we're joining a computer to the domain from a different site (so not on the same 192.168.x.x/23 subnet) to the domain controllers, we have to manually add one of the DC's IPs to the WINS server option on the network card's options. The best solution I can think of is adding option 044 for the wins server to the dhcp at every other site.

While this isn't much of an issue, is this the symptom of a DNS issue which will bite me in the ass at a later date, or is adding that option to the DHCP the correct way of dealing with it?

Slipeer
  • 3,295
  • 2
  • 21
  • 33
nuggetmcinerney
  • 21
  • 3
  • `the DNS appears to work perfectly, they're all set to 127.0.0.1 with forwarding addresses and each DHCP server giving out the correct address` - Give us exact details about this. What is using 127.0.0.1? The DC/DNS servers themselves? What DNS servers is DHCP assigning exactly? – joeqwerty Feb 02 '17 at 15:14
  • The DC's have 127.0.0.1, the DHCP servers give our the two IP addresses of the DCs. – nuggetmcinerney Feb 02 '17 at 17:37

2 Answers2

1

Are you joining the domain using the NetBIOS name or the FQDN? If you're using the NetBIOS name then my guess is that NetBIOS broadcast traffic isn't transiting the IPSec tunnel. Switch to using the FQDN when joining the domain and that should clear up the problem.

See my answer here for how name resolution works during the domain join process:

Cannot join client to domain (non virtual, DNS issue)

Community
  • 1
joeqwerty
  • 109,901
  • 6
  • 81
  • 172
0

Do not use WINS. Modern systems do not need it - enough running DNS and the correct clients settings.

If you still intend to use WINS - setup WINS feature (it does not present by default on your DC!) on one of the servers and configure clients to use it (for example through DHCP option 44).

But I strongly recommend not to use WINS.

P.S. After reading this:

We have an AD environment all linked together to domain controllers in a datacentre via ipsec tunnels - the DNS appears to work perfectly, they're all set to 127.0.0.1 with forwarding addresses ...

i recommend you check this article.

Slipeer
  • 3,295
  • 2
  • 21
  • 33
  • We don't use it per se, we simply have to set that setting to make the clients join the domain. All of the things in our network meet what's stated in that article. It's why I'm absolutely stumped. – nuggetmcinerney Feb 02 '17 at 17:39