|
>>> Jorge says "A DC by default belongs to the computed
(sic) group called ENTERPRISE DOMAIN CONTROLLERS." It is COMPUTED. >>> When I look in my forest root ADUC and in DCs, I only see
the two DCs in my forest root. I don't see the DCs in my sub-domain, the
domain in question. It is COMPUTED. >>> You're not telling me that there is an inherited
membership in EDC are you? <ventriloquy> YES </ventriloquy> Deji -----Original Message----- Gentlemen, As I understand this, Jorge is not exactly correct (far be it from me
to even intimate that, but I've got to get my head around this and I need
to challenge). These records cannot become
"ownerless". The always have an owner, do they not? In this case, the records are allowed to be
updated in the case of DHCP failover, and then only if a lease renewal is
requested, again "my" understanding. Is this correct or not? Isn't the real problem here the fact that records need to be updated at
all? >SOME< authority has to be able to do that. I see no reason
why a DC isn't the logical authority. What difference does it make where DNS
accepts an authority to modify records, either with a Netsh created account or
with a DC account. The records are getting changed. The records
need to get changed. Jorge says "A DC by default belongs to the computed (sic) group
called CONTROLLERS." When I look in my forest root ADUC and in DCs,
I only see the two DCs in my forest root. I don't see the DCs in my sub-domain,
the domain in question. You're not telling me that there is an inherited
membership in EDC are you? Finally, just tell me, as the Roaming Gnome says after plugging an
American electrical device into a foreign country's electrical network, "Am
I going to die?" if I run DHCP on my DCs (and use the Netsh created
account). Thanks in advance. RH ____________________________________________________________ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Noah Eiger Sent: Thursday, March 31, 2005 11:34 AM Subject: RE: [ActiveDir] DHCP on a DC Jorge - will running DHCP under the credentials of a user account
prevent the ownership issue you discussed below? (I think the answer is
"yes" since it would then be the same owner throughout the domain.) -----Original Message----- From: Jorge de Almeida Pinto
[mailto:[EMAIL PROTECTED] Sent: Thursday, March 31, 2005 8:13 AM Subject: RE: [ActiveDir] DHCP on a DC Hi, This is for any DNS resource record! (when DHCP is installed on a DC
and no user credentials are used) A DC by default belongs to the computed group called ENTERPRISE DOMAIN CONTROLLERS. That same group has ALL THE POWER over ALL DNS records
when AD Integrated zones are used. When DHCP is installed on a DC it
"inherits" the power from the DC and thus the DHCP can do anything with any DNS
record. As you may know the DNS records of the DCs (e.g. all kinds of service
records) are very important for the functioning of AD Logically a member server DOES NOT belong to the computed group called "inherits" the power from the member server and thus the DHCP
can't do much. It only has the power over those records it has registered on behalf of
the clients. When DHCP is installed on a DC and to mitigate the risk that the DHCP SERVICE has power over DC records and other records that it does not
own, DHCP can be configured to use an user account when doing registrations
on behalf of the client computers (http://support.microsoft.com/default.aspx?scid=kb;en-us;255134) (in
W2K use NETSH and in W2K3 use NETSH or the DHCP GUI) The following situations are also interesting: (1) Multiple DHCP servers at one location providing IP addresses and registering those addresses on behalf of those clients (2) Clients moving between different locations In both situations multiple DHCP servers need to be able to
register/update the DNS record of the clients. If DHCP is installed on a DC there is no problem as DHCP inherits its rights through the DC role. If DHCP is installed on member servers the DHCP server that registers some record
on behalf of the client automatically becomes the owner of that record
(i.e. has permissions for that record to modify it!). If another DHCP needs (because of one of the situations mentioned above) to register/update
the same record it is not allowed to do that and the record can therefore
not be updated. A solution (not recommended!) for this is to make the DHCP
server a member of the group DNSUpdateProxy. In this situation all DNS records registered by the DHCP server that is a member of that group are "owner-less", meaning that EVERYONE can update/register those
records and become the owner! Imagine this one on a DC!!! -> DON'T DO THAT!!! Even on a member server I don't recommend that, in some situations it
might be needed, although I can't think of one right now. If more than one DHCP server, regardless if it is installed on a DC or
a member server, needs to update the same records, configure DHCP to use
the credentials of some user account (http://support.microsoft.com/default.aspx?scid=kb;en-us;255134) (in
W2K use NETSH and in W2K3 use NETSH or the DHCP GUI) If DHCP is installed on a DC, configure DHCP to use the credentials of
some user account (http://support.microsoft.com/default.aspx?scid=kb;en-us;255134) (in
W2K use NETSH and in W2K3 use NETSH or the DHCP GUI) I hope this helps you understand the situations Cheers Jorge -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rocky Habeeb Sent: Thursday, March 31, 2005 17:25 Subject: RE: [ActiveDir] DHCP on a DC Tom, Thank you for responding. Do you really mean "any
record"? So it could just decide to delete the Domain Controllers OU? Or do you mean
any record in DNS, which is where I would expect it to operate? I simply
can't understand why (logically) a DC would not be the optimum place for this.
A proxy agent (member server) is still going to have and require the
requisite authority to update records so where is the security
vulnerability? I didn't mention that this is happening on W2K3 server. Does this vulnerability still apply? Thanks RH ___________________________________________ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kern, Tom Sent: Thursday, March 31, 2005 9:55 AM Subject: RE: [ActiveDir] DHCP on a DC You can install it on a DC but its not recommended. When you install a dhcp server on a DC it runs in the security context
of the DC. Every DC has full control over all the zones and records in AD.
So by proxy, so does the dhcp service running on a DC. This means it can
delete or modify any record in AD,including those created by domain memebers
and DC's. Thats a lot of power and potential for abuse and screw ups in dns and consquently, your AD forest. If you do run it on a DC, I think MS recommends you create a seperate dedicated account for the dhcp service to run under using netsh.exe Rocky Habeeb wrote: > People, > > Please consider helping me with this question. We are
getting ready > to switch to DHCP. Reading a document from MSDN entitled
"Chapter 2 > Deploying DHCP" there is a section that states "If DHCP
will perform > DNS dynamic updates, do not install it on a domain controller. > Instead, install DHCP on a member server. When DHCP is
installed on a > DC and is configured to perform dynamic updates on behalf of
clients > in DNS zones that are configured to allow only secure dynamic
update, > specify a user account to update the DNS records." > > Well, this statement is ambiguous. Can it be installed on a
DC (which > we would prefer to do for reasons of economy) or not? Is
there a > problem with doing it? > > Thank you people in advance. > > RH > > _____________________________ > > Rocky Habeeb > Microsoft Systems Administrator > James W. Sewall Company > > Voice: 207.827.4456 Ext. 387 > Email: [EMAIL PROTECTED] > www.jws.com > _____________________________ > > > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: > http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/ This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be
copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/ |
- RE: [ActiveDir] DHCP on a DC Jorge de Almeida Pinto
- RE: [ActiveDir] DHCP on a DC deji
- RE: [ActiveDir] DHCP on a DC Rocky Habeeb
- RE: [ActiveDir] DHCP on a DC Jorge de Almeida Pinto
