DNS

The system detected a possible attempt to compromise security

I got the above error when trying to access a network share on a workstation. The event log was filled with Cifs and netlogon errors.  In doing some investigation I found that this machine had a manually set DNS entry which pointed to a former DC that had been demoted. What was interesting is that DNS resolution still worked (cached entries) but because it wasn’t authorized in AD the machine was getting cifs errors.

Unable to join domain “The network location cannot be reached”

I got this error when joining a windows XP to the domain. I ensured that DNS resolution was working fine.  After some testing I determined that the issue was NetBIOS resolution.

An Ipconfig /all showed that there was no WINS server address (even though DHCP should be giving one out) and NetBIOS over TCP was showing as disabled. I manually enabled this and added a WINS server address but another Ipconfig /all showed no change. Ok so the TCP/IP stack got corrupted, no biggie, easy to fix by removing the NIC drivers and re-adding them forcing Windows to create another stack but this leads into the rant.

Why do I need NetBIOS resolution to join an XP machine to the domain when I have DNS resolution? Why do I need NetBIOS resolution at all? NetBIOS resolution  was crap 10 years ago and it’s even crappier and less necessary now. NetBIOS resolution is the tonsils of the network world. The worst part is that when NetBIOS resolution breaks you don’t even get a week off of school and all the ice cream you can eat.

Migrating DNS records

I am really tired of the way some people handle DNS record changes. It’s like people (even people in the IT industry) don’t seem to realize that changes are not instant. It takes on average between 24-48 hours for any record changes to propagate across the Internet and yet you have DNS cowboys trying to cut-over records and then wonder why names aren’t resolving, or mail isn’t flowing.

Best rule of thumb I have seen is maneuver your record change in a way that for that 24-48 hour period either record will work, if you can’t do that at least make your change on Friday before you head to the pub and make sure everyone knows that things may not work properly during the weekend.