Active Directory DNS Integration White Paper Abstract This paper describes how Active Directory uses the Domain Name System (DNS) in conjunction with the Windows Domain Locator service for distributed computing environments. It discusses how the Adonis Server integrates into existing or new Active Directory deployments. DNS replication mechanisms are discussed including their pros and cons. Active Directory records and DNS labeling conventions are described in detail to give the reader a deeper understanding how the locator service works. USE OF THIS DOCUMENT Publisher Information All rights reserved worldwide. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any human or computer language in any form or by any means without the express written permission of: BlueCat Networks, Inc. 9050 Yonge Street, Suite 401 Richmond Hill, Ontario Canada L4C 9S6 Attention: General Manager Telephone: 905-882-5691 Fax: 905-882-5057 E-mail: [email protected] Web Site: www.bluecatnetworks.com This publication is provided as is without warranty of any kind, express or implied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. All terms mentioned in this publication that are known to be trademarks or service marks are appropriately capitalized. BlueCat Networks cannot attest to the accuracy of this information. Use of a term in this publication should not be regarded as affecting the validity of any trademark or service mark. The trademarks, service marks and logos (the "Trademarks") displayed are registered and unregistered Trademarks of BlueCat Networks, Inc. and others. Users are not permitted to use these Trademarks for any purpose without the prior written consent of BlueCat Networks or the third party owning the Trademark. Copyright This document and all information (in text, Graphical User Interface ("GUI"), video and audio forms), images, icons, software, design, applications, calculators, models, projections and other elements available on or through this document are the property of BlueCat Networks or its suppliers, and are protected by Canadian and international copyright, trademark, and other laws. Your use of this document does not transfer to you any ownership or other rights or its content. You acknowledge and understand that BlueCat Networks retains all rights not expressly granted. © 2004 BlueCat Networks, Inc. All rights reserved. All brands and trademarks are the property oftheir respectve owners. Actual implementation and configuration may vary. E. & O.E. i No Professional Advice This document is for convenience and informational purposes only. This document is not intended to be a comprehensive or detailed statement concerning the matters addressed; advice or recommendations, whether scientific or engineering in nature or otherwise; or an offer to sell or buy any product or service. BlueCat Networks does not warrant or make any representations regarding the use, validity, accuracy, or reliability of, or the results of the use of, this web site or any materials on this document or any web site referenced herein. This document is intended solely for the use of the recipient. It does not institute a complete offering and is not to be reproduced or distributed to any other person. Persons who receive this document agree that all information contained herein is exclusively the intellectual property of BlueCat Networks and will not reproduce, recreate or other use material herein, unless you have received expressed written consent from BlueCat Networks. © Copyright 2004 BlueCat Networks, Inc. © 2004 BlueCat Networks, Inc. All rights reserved. All brands and trademarks are the property oftheir respectve owners. Actual implementation and configuration may vary. E. & O.E. ii CONTENTS INTRODUCTION................................................................................................... 1 ACTIVE DIRECTORY AND DNS ......................................................................... 1 DYNAMIC DOMAIN CONTROLLER REGISTRATION........................................ 2 INTEGRATING THE ADONIS INTO ACTIVE DIRECTORY ................................ 4 DNS REPLICATION ............................................................................................. 5 ADVANTAGES OF ADONIS FOR ACTIVE DIRECTORY DNS SERVICES ........ 7 SUMMARY............................................................................................................ 9 ACTIVE DIRECTORY DNS RECORDS ............................................................... 9 SRV Records.................................................................................................. 9 A Records..................................................................................................... 11 CNAME Records .......................................................................................... 11 © 2004 BlueCat Networks, Inc. All rights reserved. All brands and trademarks are the property oftheir respectve owners. Actual implementation and configuration may vary. E. & O.E. iii INTRODUCTION Windows® 2000 Server was a pivotal point for Microsoft in centralizing and consolidating directory services. Active Directory® (AD) is based on well known network services such as Lightweight Directory Access Protocol (LDAP) and Kerberos and utilizes DNS for its location mechanism. DNS has now grown to become not only the cornerstone of the Internet, but a crucial fabric to connect Windows clients with their Domain Controllers. This document will outline how Active Directory utilizes DNS and how the Adonis DNS Appliance integrates into this environment. The integration of the Adonis Server can be performed easily while providing a robust, secure and highly maintainable DNS management platform. ACTIVE DIRECTORY AND DNS Active Directory is an essential element of the Windows server architecture that provides a centrally managed directory service for distributed computing environments. The directory is a central authority for network security, resources, users and services. Active Directory is based upon the LDAP and uses security based on MIT's Kerberos project. AD was first available in Windows 2000 Server. Microsoft chose to change its Windows Domain discovery process to use DNS instead of its legacy discovery protocol. This acts like a boot strapping mechanism for client systems to find the closest or most appropriate Domain Controller (DC). This information is stored in a series of DNS records specifying the following information: LDAP Servers Kerberos Domain Controllers Address of the Domain Controllers Global Catalog Servers Kerberos Password Change Servers Before a client can connect to the Windows Domain, a suitable DC needs to be found. The Windows client contains a service called NetLogon which uses a Domain Controller locating algorithm to find the appropriate server. This algorithm works in the following manner: 1. A List of DCs is obtained via a DNS query using the domain name, domain GUID and/or site name. 2. The locator will ping each controller in random order and use the weight- ing factor discovered while getting the list of DCs. It will wait up to 1/10th of a second for a reply from the DC. The pinging continues until all DCs have been tried or until a successful response has been received. © 2004 BlueCat Networks, Inc. All rights reserved. All brands and trademarks are the property oftheir respectve owners. Actual implementation and configuration may vary. E. & O.E. 1 3. After a DC responds successfully to a ping, the results from the response are compared to the parameters required by the client. If this matches then the DC is used, otherwise pinging of other DCs resumes. Adonis DNS 1. Query DNS for a list of Domain Controllers Domain Controller 2. Ping Domain Controllers remotely Client Workstation 3. Select Domain Controller that satisfies connection parameters Domain Controller Figure 1: Locating an appropriate Domain Controller DYNAMIC DOMAIN Without the proper DNS information, a client cannot find out which server to CONTROLLER REGISTRATION contact for authentication. Each Domain Controller registers and maintains it own Active Directory DNS integration records which consist of several A (Address), CNAME (Canonical Name) and SRV (Service) records. These records are initially registered by the DC's NetLogon service. This is performed via standard DNS zone transfer (AXFR), query and Dynamic DNS Update (RFC 2136) by the DC © 2004 BlueCat Networks, Inc. All rights reserved. All brands and trademarks are the property oftheir respectve owners. Actual implementation and configuration may vary. E. & O.E. 2 Slave DNS Server Slave DNS Server Master DNS Server 1. Perform transfer of Active Drectory zone 3. Send updates to slave servers via Incremental Zone Transfer (IXFR) 2. Send Dynamic Updates to add/update controller's records Domain Controller Figure 2: Registering Active Directory Records When examining these records in the Microsoft DNS server, one is led to believe that this data must reside in sub zones of the parent domain. This is not necessarily the case, since Dynamic DNS (DDNS) updates have no way of creating additional zones. The records are simply added as resource records with label separators (".") into the parent domain. Additionally one will notice that several of the records contain underscore ("_") characters as part of the names. This technique is common practice used in Microsoft