You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/windows-server/active-directory/deployment-operation-ad-domains.md
+23-23Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,26 +25,26 @@ This article provides application compatibility information for scenarios in whi
25
25
For the following reasons, create new Active Directory domains that have fully qualified DNS names:
26
26
27
27
- You can't use an internet registrar to register single-label DNS names.
28
-
- When joined to single-label domains, client computers (both domain-joined and nondomain-joined) and domain controllers require extra configuration to dynamically register DNS records in single-label DNS zones.
29
-
- Client computers (domain-joined, nondomain-joined, and Microsoft Entra ID-joined) and domain controllers require extra configuration to resolve DNS queries in single-label DNS zones.
28
+
- When joined to single-label domains, client computers (both domain-joined and nondomain-joined) and domain controllers (DCs) require extra configuration to dynamically register DNS records in single-label DNS zones.
29
+
- Client computers (domain-joined, nondomain-joined, and Microsoft Entra ID-joined) and DCs require extra configuration to resolve DNS queries in single-label DNS zones.
30
30
- Some server-based applications are incompatible with single-label domain names. Newly released applications might not support single-label DNS names, and applications that support single-label DNS names might drop that support in the future.
31
31
- Transitioning from a single-label DNS domain name to a fully qualified DNS name is nontrivial and consists of two options:
32
32
33
33
- Migrate users, computers, groups, and other states to a new forest.
34
34
- Rename the existing domain.
35
35
36
36
> [!IMPORTANT]
37
-
> Current Microsoft applications don't support domain renaming. As a result, don't try to rename a single-label DNS name to a fully qualified domain name.
37
+
> Current Microsoft applications don't support domain renaming. Therefore, don't try to rename a single-label DNS name to a fully qualified domain name.
38
38
39
39
- In Windows Server 2008, the Active Directory Installation Wizard (Dcpromo.exe) warns against creating new domains that have single-label DNS names. There's no business or technical reason to create new domains that have single-label DNS names. In Windows Server 2008 R2 and later versions, the Active Directory Installation Wizard explicitly blocks creating such domains.
40
40
41
-
Previous versions of this article provided information about Microsoft applications that specifically didn't support domain renaming. Currently, no Microsoft applications support domain renaming, so the distinction of the list isn't needed anymore.
41
+
Previous versions of this article listed Microsoft applications that specifically didn't support domain renaming. Currently, no Microsoft applications support domain renaming. Therefore, the distinction that's provided by that list is no longer needed.
42
42
43
43
## More information
44
44
45
45
Single-label names consist of a single word, such as "contoso."
46
46
47
-
Best-practice Active Directory domain names consist of one or more subdomains that you combine with a top-level domain. A dot character (".") separates the two components, as shown in the following examples:
47
+
Best-practice Active Directory domain names consist of one or more subdomains that you combine with a top-level domain. A period (".") separates the two components, as shown in the following examples:
48
48
49
49
- contoso.com
50
50
- corp.contoso.com
@@ -54,20 +54,20 @@ The top-level domain occupies the rightmost label in a domain name. A large numb
54
54
- .com
55
55
- .net
56
56
- .org
57
-
- Two-letter country code top-level domains (ccTLD) such as .nz
58
-
- Generic names such as "local." However, in these circumstances generic names might cause other issues.
57
+
- Two-letter country code top-level domains (ccTLD), such as .nz
58
+
- Generic names such as "local." However, in these situations, generic names might cause other issues.
59
59
60
60
To support current and future operating systems and reliable applications, use two or more labels for Active Directory domain names. For examples of invalid top-level domain queries, see [Invalid Top Level Domain Queries at the Root Level of the Domain Name System (ICANN Security and Stability Advisory Committee)](http://www.icann.org/groups/ssac/documents/sac-045-en.pdf).
61
61
62
62
### Registering DNS names with an internet registrar
63
63
64
-
Use an internet registrar to register DNS names for the top-most internal and external DNS namespaces of your domain. These DNS namespaces include the forest root domains of any Active Directory forests, unless such names are subdomains of previously-registered domains. (For example, the forest root domain "corp.example.com" is a subdomain of an internal "example.com." namespace.) When you register your DNS names with an internet registrar, internet DNS servers resolve your domain now or at some point over the life of your Active Directory forest. This registration also helps prevent name collisions by other organizations.
64
+
Use an internet registrar to register DNS names for the top-most internal and external DNS namespaces of your domain. These DNS namespaces include the forest root domains of any Active Directory forests, unless such names are subdomains of previously-registered domains. (For example, the forest root domain "corp.example.com" is a subdomain of an internal "example.com." namespace.) When you register your DNS names with an internet registrar, internet DNS servers resolve your domain either now or at some point over the life of your Active Directory forest. This registration also helps prevent name collisions by other organizations.
65
65
66
66
### Symptoms that indicate clients can't dynamically register DNS records in a single-label forward lookup zone
67
67
68
68
If you use a single-label DNS name in your environment, clients might be unable to dynamically register DNS records in a single-label forward lookup zone. Specific symptoms vary for different versions of Windows, but might include the following symptoms:
69
69
70
-
- After you configure single label domain name, domain controllers can't register DNS records. The System logs of the domain controllers consistently log NetLogon Event ID 5781, "Dynamic registration or deletion of one or more DNS records associated with DNS domain 'intranet.example.com.' failed."
70
+
- After you configure single label domain name, DCs can't register DNS records. The system logs of the DC consistently log NetLogon Event ID 5781, "Dynamic registration or deletion of one or more DNS records associated with DNS domain 'intranet.example.com.' failed."
71
71
72
72
- Clients receive DNS errors that resemble the following error codes:
73
73
@@ -83,14 +83,14 @@ If you use a single-label DNS name in your environment, clients might be unable
83
83
Consider the following configuration:
84
84
85
85
- Domain member computers reside in a forest that doesn't contain any single-label DNS domains.
86
-
-Domain controllers reside in single-label DNS domains in a different forest.
86
+
-DCs reside in single-label DNS domains in a different forest.
87
87
88
88
In this configuration, you see the following default behaviors:
89
89
90
-
- By default, the client computers don't use the DNS Server service to locate the domain controllers.
90
+
- By default, the client computers don't use the DNS Server service to locate the DCs.
91
91
- By default, Windows DNS clients don't send updates to top-level domains.
92
92
93
-
These behaviors cause DNS resolution issues. To mitigate them, you have to change the configurations of the Windows client computers (domain-joined, nondomain-joined, or Microsoft Entra ID-joined) and the domain controllers. To change the configurations, use one of the two methods in this section.
93
+
These behaviors cause DNS resolution issues. To mitigate the issues, you have to change the configurations of the Windows client computers (domain-joined, nondomain-joined, or Microsoft Entra ID-joined) and the DCs. To change the configurations, use one of the two methods in this section.
94
94
95
95
> [!IMPORTANT]
96
96
> Before you use either method, make sure that NetBIOS name resolution works correctly in your environment. Otherwise, clients can't access the domains that have single-label DNS names fails.
@@ -99,21 +99,21 @@ These behaviors cause DNS resolution issues. To mitigate them, you have to chang
99
99
100
100
[!INCLUDE [registry important alert](../../../includes/registry-important-alert.md)]
101
101
102
-
##### Step 1: Change the domain controller locator configuration
102
+
##### Step 1: Change the DC locator configuration
103
103
104
104
On the Windows client computers (domain-joined, nondomain-joined, or Microsoft Entra ID-joined), follow these steps:
105
105
106
106
1. In the Search box, enter regedit, and then select **Registry editor**.
107
-
1. Locate and then select the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters` subkey.
107
+
1. Locate and select the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters` subkey.
108
108
1. In the details pane, locate the `AllowSingleLabelDnsDomain` entry. If the entry doesn't exist, follow these steps:
109
109
1. Select **Edit** > **New** > **DWORD Value**.
110
110
1. In the **Name** box, enter **AllowSingleLabelDnsDomain**.
111
111
1. Double-click the **AllowSingleLabelDnsDomain** entry, and then in **Value data**, enter **1**.
112
-
1. Close Registry Editor, and then restart the computer.
112
+
1. Close Registry Editor, and restart the computer.
113
113
114
114
##### Step 2: Change the dynamic update configuration for the DNS root zone or single-label DNS zones
115
115
116
-
Apply these changes to all domain controllers and members of domains that have single-label DNS names. If a domain that has a single-label DNS name is a forest root domain, apply these changes to all the domain controllers in the forest, unless the separate zones \_msdcs. *ForestName*, \_sites. *ForestName*, _tcp. *ForestName*, and \_udp. *ForestName* are delegated from the *ForestName* zone.
116
+
Apply these changes to all DCs and members of domains that have single-label DNS names. If a domain that has a single-label DNS name is a forest root domain, apply these changes to all the DCs in the forest, unless the individual zones (\_msdcs. *ForestName*, \_sites. *ForestName*, _tcp. *ForestName*, \_udp. *ForestName*) are delegated from the *ForestName* zone.
117
117
118
118
Follow these steps:
119
119
@@ -122,12 +122,12 @@ Follow these steps:
122
122
1. In the details pane, locate the `UpdateTopLevelDomainZones` entry. If the entry doesn't exist, follow these steps:
123
123
1. Select **Edit** > **New** > **DWORD Value**.
124
124
1. In the **Name** box, enter **UpdateTopLevelDomainZones**.
125
-
1. Double-click the **UpdateTopLevelDomainZones** entry, and then in**Value data**, enter**1**.
126
-
1. Close Registry Editor, and then restart the computer.
125
+
1. Double-click the **UpdateTopLevelDomainZones** entry, and then enter**1** in**Value data**.
126
+
1. Close Registry Editor, and restart the computer.
127
127
128
128
#### Method 2: Use Group Policy
129
129
130
-
Use Group Policy to enable the **Update Top Level Domain Zones** policy and the **Location of the DCs hosting a domain with single label DNS name** policy as specified in the following table. Configure these policies under the folder location on the root domain container in **Users and Computers**, or on all organizational units (OUs) that host computer accounts for member computers and for domain controllers in the domain.
130
+
Use Group Policy to enable the **Update Top Level Domain Zones** policy and the **Location of the DCs hosting a domain with single label DNS name** policy. Configure these policies under the folder location on the root domain container in **Users and Computers**, or on all organizational units (OUs) that host computer accounts for member computers and for DCs in the domain. Use the values that are specified in the following table.
131
131
132
132
|Policy|Folder location|
133
133
|---|---|
@@ -136,9 +136,9 @@ Use Group Policy to enable the **Update Top Level Domain Zones** policy and the
136
136
137
137
To enable these policies, follow these steps on the root domain container:
138
138
139
-
1. In the Group Policy Management Console (GPMC), double-click the domain policy that you want to configure. If you want all computers to behave in the same way, double-click a global policy such as **Default Domain Policy**.
139
+
1. In the Group Policy Management Console (GPMC), double-click the domain policy that you want to configure. If you want all computers to behave in the same manner, double-click a global policy such as **Default Domain Policy**.
1. In the details pane, double-click **Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC**.
143
143
1. Select **Enabled**, select **Apply**, and then select **OK**.
144
144
1. Under **Administrative Templates**, expand **System** > **Net Logon** > **DC Locator DNS Records**.
@@ -158,7 +158,7 @@ Check the DNS servers to make sure that root servers aren't created unintentiona
158
158
159
159
-**Update Top Level Domain Zones**
160
160
161
-
If you enable this policy, it creates a `REG_DWORD UpdateTopLevelDomainZones` entry under the `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` registry subkey. You can select one of the following values:
161
+
If you enable this policy, it creates a `REG_DWORD UpdateTopLevelDomainZones` entry under the `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` registry subkey. You can select one of the following values.
162
162
163
163
| Value | Name | Description |
164
164
| --------- | - | --------- |
@@ -167,7 +167,7 @@ Check the DNS servers to make sure that root servers aren't created unintentiona
167
167
168
168
-**Register PTR Records**
169
169
170
-
This policy isn't new, but it has a new possible value. If you enable this policy, it creates a `REG_DWORD RegisterReverseLookup` entry under the `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` registry subkey. You can select one of the following values:
170
+
This policy isn't new, but it has a new possible value. If you enable this policy, it creates a `REG_DWORD RegisterReverseLookup` entry under the `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` registry subkey. You can select one of the following values.
0 commit comments