0

I'm very new to the world of active directory, windows server etc., so I apologise if some of the questions I ask are a bit stupid, but I'll try and explain exactly what I want to do below, and my currrent setup.

I'm running Ubuntu Server on a Raspberry Pi, using kerberos and other software detailed in this video to use it as an AD-DC for my four clients that connect to it. At the moment this is really a test network on my Pi 2, before I launch on my Pi 4. The Raspbrry Pi is only just powerful enough to run the network and authenticate user logons and manage group policy etc, but DNS resolutions are extremely slow.

From the client perspective, the network is operating completely fine with logons and policy etc. EXCEPT what they have noticed is the time it takes to make a quick google search has increased dramatically and sometimes the search even fails.

Now, here's the question... is there a way to operate my AD-DC server setup to manage group policy, users, groups, logon etc. without sending external DNS requests e.g. bbc.co.uk or google.com via the AD-DC. I want them to be processed as they would have before the server came along (by the router??) simply because it can't handle them, and the setup before the server was perfectly fine at handling them

The windows clients are configured in dns settings to use the ADDC as their preferred dns server (if I change this, then they lose connection to the domain and can't find it...) and use 8.8.8.8 google's dns server as their secondary one, but whether I enter this in or not doesn't really seem to have an effect.

And if the ADDC server is down, ALL external dns requests across the entire network fail. It's like the backup isn't even there. You can't get onto google from a client when the DC is down.

Any info I'm happy to provide.

Secondary bonus question wondering why samba network transfer speed is dramatically slower using AD on this rapsberry pi rather than just installing samba and having it as a network share. Gone from 30Mb/s to 2Mb/s

0

1 Answer 1

1

The windows clients are configured in dns settings to use the ADDC as their preferred dns server (if I change this, then they lose connection to the domain and can't find it...) and use 8.8.8.8 google's dns server as their secondary one

That's an invalid configuration, prone to unexpected errors in the Active Directory context. In an AD environment your (Windows) clients must not use a DNS server that doesn't know about your internal AD setup.

Is there a way to operate my AD-DC server setup to manage group policy, users, groups, logon etc. without sending external DNS requests e.g. bbc.co.uk or google.com via the AD-DC

The Domain Controller for Active Directory must be canonical for your DNS domain. If you're asking whether you can have clients that don't use the DC for external DNS requests, then the answer is a qualified yes.

  1. All DNS requests for your AD-controlled DNS domain must go to a DC
  2. DNS requests for somewhere else may be resolved by any suitably responsive DNS server
  3. You must not send DNS requests for your internal AD-controlled domain to an external server because its "NXDOMAIN" response will cause breakage

In the case of #2 for a Linux-based or other UNIX system clients you can use either systemd or dnsmasq to implement the stateful selection. (I've done both in various cases previously.)

  • systemd

    Create /etc/systemd/network/20-local.network, setting the DNS server to be your AD DC, and your local domain as appropriate, remembering the leading ~:

    # Network interface name (*=any)
    [Match]
    Name=*
    
    # Specific DNS server(s) to use for this domain
    [Network]
    DNS=10.0.0.1
    Domains=~contoso.com
    

    Create /etc/systemd/resolved.conf.d/20-local.conf, setting the default external DNS servers as appropriate:

    [Resolve]
    DNS=1.1.1.1 9.9.9.9
    

    Reload the network and check the resolver

    systemctl restart systemd-networkd
    resolvectl status
    

    You should see that queries for your AD-controlled domain go to your Domain Controller, and everything else goes to 1.1.1.1 and/or 9.9.9.9.

  • dnsmasq.conf

    Edit /etc/dnsmasq.conf setting the following values appropriately:

    # Global nameservers
    server=1.1.1.1
    server=9.9.9.9
    
    # Domain-specific nameserver (forward and reverse)
    server=/contoso.com/10.0.0.1
    server=/1.0.0.10.in-addr.arpa/10.0.0.1
    

    Restart dnsmasq


Potentially useful references

17
  • Wow, seriously helpful answer you've understood exactly what I'm getting at. Sorry for the lack of experience or basic knowledge when I'm tackling such a thing. I'll give it a go now, should I remove the secondary 'alternative dns server' option being 8.8.8.8 on the windows clients? Thanks for this @Chris Davies Nov 3, 2023 at 15:22
  • Can I also ask what happens if the DC is down/offline? Users that have logged into that particular client computer in the past will be allowed to log on, obviously network shares won't be available, but will external DNS requests still be handled? E.g. as they would have been before the whole domain existed i.e externally? Nov 3, 2023 at 15:26
  • And finally sorry, am I leaving "[Match] Name=enxb827eb315364" as that string, or have I got a name to enter there? Nov 3, 2023 at 15:36
  • I have followed your instructions exactly and get to the point where I am checking the resolvectl status and i get the response 'failed to get global data: unit dbus-org.freedesktop.resolve1.service not found; Nov 3, 2023 at 15:42
  • You are doing these changes on clients and not on your AD DC server, aren't you. It sounds like they're not using systemd's resolver. You can start it with systemctl start systemd-resolved but I would double-check how DNS resolving is happening on these clients before you make these changes Nov 3, 2023 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .