Windows Server

Jordan Samulaitis · Guest

Hello All,

I am trying to verify that my DNSUpdateProxy group is setup correctly, to my
understanding if the DHCP server and DNS server use the DC as the
DNSUpdateProxy group the DC owns the updates.

I looked under the members tab of the DNSUpdateProxy group and noticed the
Administrator account is in there, is that a good enough user to have in
that group? or should i create a specific one for the ownership of the
registrations?

Thanks,

Jordan

Brian O'Neil · Guest

There are two different scenarios in which you would use the DNSUpdateProxy
group.
1. Your DHCP server is NOT a domain controller. You would put the computer
account of the DHCP server in this group. This "relaxes" the security on the
registered resource records so clients and\or DHCP servers can update the
records.

2. Your DHCP server IS on a 2003 domain controller.
(This only applies to Windows Server 2003; you should never use a Windows
2000 domain controller as a DHCP server.)
Access the DHCP MMC and get the advanced properties of the DHCP server, in
the MMC you can specify an AD user account to register records on behalf of.
Create the user account in AD and enter the user name and password in the
DHCP server. Add this user account to the DNSUpdateProxy group.

You should never put a domain controller computer account in the
DNSUpdateProxy group because it will relax the security of the DC's resource
records to the point of where anyone can update them. Thats a huge security
and reliability vulnerability.

-Brian

"Jordan Samulaitis" wrote:

Roger Abell [MVP] · Guest

What specifically made you believe that you needed to use
this group? Normally one has no use for it. If you place in
it a machine account then records registered by that account
will be allowed to be updated (and so "ownership-claimed") by
other machines which next/first attempt to update the record.
Normally this is undesirable behavior although there are
situations where it is needed.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCDBA, MCSE W2k3+W2k+Nt4
"Jordan Samulaitis" <jordan@jvsDELETEnetworks.com> wrote in message
news:uolQXDS$EHA.1524@TK2MSFTNGP09.phx.gbl...

Ulf B. Simon-Weidner [MVP · Guest

"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:mvpNoSpam@asu.edu:

	Windows Server Forum Index -> DNS	All times are GMT
Page 1 of 1