Using Active Directory integrated zones in Windows 2000 Server

by Jim Boyce | May 14, 2007 7:00:00 AM

Tags: Domain names, Servers, Jim Boyce, DNS, Microsoft Windows 2000, server, domain name, advertisement, Microsoft Windows, Microsoft Windows 2000 Server, Windows 2000 Server Tips Newsletter

0 comment(s)

Takeaway: Learn about zone files -- plain text records within your Windows 2000 DNS Server that allow for integrated redundancy and security across your system, including in Active Directory.

Domain Name System (DNS) servers save all resource records in a special file called a zone file. This is a plain-text file that can be edited with any text editor. In Windows 2000 these files are usually located in the %systemroot%\system32\dns directory and have a .dns extension.

Windows 2000 DNS zones that store records in these text files are called standard primary and standard secondary zones. The third zone type supported in Windows 2000 Active Directory (AD) is an integrated zone. The records of these zones are not saved in text files anymore, but rather, are saved as objects in Active Directory.

The most obvious advantage of using AD integrated zones is redundancy; thus, there's no single point of failure in DNS design. In DNS design, only standard primary servers contain a writeable copy of a zone file that's then transferred to standard secondary servers. These servers hold read-only copies of the zone. Thus, if a standard primary server fails, you can't update DNS records until the server is back online or you promote some other server from secondary to primary. With Active Directory integrated zones, this cannot work because all domain controllers in a domain hold the zone information and all can write to it. Also, the AD replication process takes care of DNS replication.

Another advantage of AD integrated zones is security. You can now turn on Secured Dynamic Updates and thus allow only authorized clients to update records in DNS. In addition, every resource record gets an ACL similar to ACL files on NTFS partitions.

AD integrated zones aren't perfect, though. The biggest disadvantage can be performance degradation. Because all data is in AD, you can expect the rate of dynamic updates to decrease by a factor of two.