AD DS: This domain controller must register an alias (CNAME) resource record with its DsaGuid for the forest

  • Article

Updated: August 31, 2012

Applies To: Windows Server 2008 R2, Windows Server 2012

This topic is intended to address a specific issue identified by a Best Practices Analyzer scan. You should apply the information in this topic only to computers that have had the Active Directory Domain Services Best Practices Analyzer run against them and are experiencing the issue addressed by this topic. For more information about best practices and scans, see Best Practices Analyzer (https://go.microsoft.com/fwlink/?LinkId=122786).

Operating System

Windows Server 2008 R2

Windows Server 2012

Product/Feature

Active Directory Domain Services (AD DS)

Severity

Error

Category

Configuration

Issue

The "DsaCname" Domain Name System (DNS) alias (CNAME) resource record that ensures correct replication functionality is not registered on this domain controller. All writeable domain controllers must register this record.

Impact

Replication is not functioning correctly on this domain controller. If other domain controllers in the domain or forest are not able to resolve the CNAME record of this domain controller, the changes that are made on this domain controller will not be replicated to any other domain controllers in the domain or forest.

Resolution

Ensure that "DsaCname" is not configured in the “DnsAvoidRegisteredRecords” list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS CNAME resource record <<CNAME-NAME>> pointing to the local domain controller "<<FQDN of local DC>>", is registered in DNS.

To resolve this issue, complete the following tasks:

  • Locate the DNS record: Determine whether the “<<DsaGuid>>._msdcs.<<DnsForest name>>” DNS alias (CNAME) resource record is registered in DNS.

  • Verify Group Policy settings: If “<<DsaGuid>>._msdcs.<<DnsForest name>>” is not registered in DNS and if this is a writable domain controller, verify that DsaCname is not included in the list of mnemonics that are specified for the Group Policy setting DC Locator DNS records not registered by the DCs.

Note

The mnemonics that are specified for the DC Locator DNS records not registered by the DCs Group Policy setting correspond to the DNS records that are not to be registered by this domain controller.

  • Verify registry settings: If the “<<DsaGuid>>._msdcs.<<DnsForest name>>” DNS alias (CNAME) resource record is not registered in DNS and if this is a writable domain controller, verify that DsaCname is not included in the list of mnemonics that are specified for the multivalued registry key DnsAvoidRegisterRecords.

Note

The mnemonics that are specified for the DnsAvoidRegisterRecords registry key correspond to the DNS records that are not to be registered by this domain controller.

  • Restart the Netlogon service, and verify that the “<<DsaGuid>>._msdcs.<<DnsForest name>>” DNS service (SRV) resource record has been registered in DNS.

Note

You can use the Dcdiag tool to further investigate and resolve a continuing failure to register this record. For more information, see DCDiag and NetDiag in Windows 2000 Facilitate Domain Join and DC Creation (https://go.microsoft.com/fwlink/?LinkId=136425) and Dcdiag Overview (https://go.microsoft.com/fwlink/?LinkID=130605).

Membership in Domain Admins, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

To locate the “&lt;&lt;DsaGuid&gt;&gt;._msdcs.&lt;&lt;DnsForest name&gt;&gt;” DNS service (SRV) resource record

  1. Open the DNS Manager snap-in. To open DNS Manager, click Start, click Administrative Tools, and then click DNS.

  2. In the console tree, expand the applicable forward lookup zone, and then click the _msdcs.<<DnsForest name>> node.

  3. In the details pane, locate the <<DsaGuid>> record of the type Alias (CNAME).

To verify the mnemonics that are specified for the “DC Locator DNS records not registered by the DCs” Group Policy setting

  1. Open the Group Policy Management snap-in. To open Group Policy Management, click Start, click Administrative Tools, and then click Group Policy Management.

  2. To determine if the Group Policy setting DC Locator DNS records not registered by the DCs is set by one or more Group Policy objects (GPOs), in Group Policy Management, right-click Group Policy Results, and then click Group Policy Results Wizard. Run the Group Policy Results Wizard for this domain controller.

    If the Group Policy setting DC Locator DNS records not registered by the DCs is set, it appears in the generated Group Policy results in the Group Policy Management snap-in.

  3. In the Group Policy Management console tree, expand Group Policy Results, and then select the generated results report.

  4. To view the list of mnemonics that correspond to the DNS records that should not be registered by this domain controller, in the details pane, expand Administrative Templates, and then expand System/ Net Logon/ DC Locator DNS Records.

Membership in System Admins, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

To verify or edit the value of the DnsAvoidRegisterRecords registry key

  1. Open Registry Editor. To open Registry Editor, click Start, click Run, and then type regedit.

  2. Navigate to HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.

  3. To view or edit the list of mnemonics that correspond to the DNS records that should not be registered by this domain controller, double-click the multivalued registry key DnsAvoidRegisterRecords.

Additional references

For more information, see DNS Support for Active Directory Tools and Settings (https://go.microsoft.com/fwlink/?LinkId=136428).