1

I have read in MS docs that by default DomainDnsZones.domain.com and ForestDnsZones.domain.com app partitions are created when dcpromo is run on the first DC in the forest.

Isn't _msdcs not also created? Is it just a DNS zone or is it also its own app partition?

red888
  • 4,069
  • 16
  • 58
  • 104

1 Answers1

1

AD Partitions and DNS zones are different things. Zones (configured as type Active Directory Integrated) are stored in the AD partition, similar to how files are stored within an NTFS partition. MSDCS can be a zone or a sub zone, Microsoft has used different defaults for different OS versions over the years, but is not a partition.

Zones can also be configured as type "primary" which is simply a file on the filesystem, that you can also open with notepad. However, most Windows DNS installations use AD Integrated DNS because it allows each DNS server to be a DNS master and accept Dynamic DNS update requests from clients.

You can enumerate DNS zones with DNSCMD.EXE /enumzones
You can enumerate AD partitions with DSQUERY.EXE partition

dsquery partition
"CN=Configuration,DC=acme,DC=com"
"CN=Schema,CN=Configuration,DC=acme,DC=com"
"DC=acme,DC=com"
"DC=DomainDnsZones,DC=acme,DC=com"
"DC=ForestDnsZones,DC=acme,DC=com"

You can use the ADSIEdit MMC to connect to the partitions and see which partitions the MSDCS zone is stored in. If you domain was upgraded from Win2000 you need to take steps to move the MSDCS data from the Domain DNS partition to the Forest DNS partition. https://support.microsoft.com/en-us/kb/817470 If MSDCS has not been moved to Forest DNS, it will not be listed with DNSCMD /enumzones. The MSDCS records are still there, you can find the MSDCS node in the DNS MMC tree beneath domain.com.

Clayton
  • 4,483
  • 16
  • 24