You want to prevent a domain controller from dynamically registering certain resource records. It is sometimes advantageous to prevent certain resource records from being dynamically registered. For example, if you want to reduce the load on the PDC Emulator for a domain, you could prevent some of its SRV records from being published, which would reduce the amount of client traffic the server receives.
22.214.171.124 Using a command-line interface
This command will disable the Ldap, Gc, and GcIpAddress resource records from being dynamically registered:
> reg add HKLM\System\CurrentControlSet\Services\Netlogon\Parameters /v[RETURN] DnsAvoidRegisterRecords /t REG_MULTI_SZ /d Ldap\0Gc\0GcIpAddress The operation completed successfully. > net stop netlogon The Net Logon service is stopping. The Net Logon service was stopped successfully. > del %SystemRoot%\system32\config\netlogon.dnb > net start netlogon The Net Logon service is starting....... The Net Logon service was started successfully.
126.96.36.199 Using VBScript
' This code prevents a DC from registering the resource records ' associated with the Ldap, Gc, and GcIpAddress mnemonics and must be run ' directly on the server. ' Create Registry Value const HKLM = &H80000002 set objReg = GetObject("winmgmts:root\default:StdRegProv") strKeyPath = "System\CurrentControlSet\Services\Netlogon\Parameters" ' prevent Ldap, Gc, and GCIpAddress records from being registered arrValues = Array("Ldap","Gc","GcIpAddress") if objReg.SetMultiStringValue(HKLM,strKeyPath,"DnsAvoidRegisterRecords", _ arrValues) <> 0 then WScript.Echo "Error creating registry value" else WScript.Echo "Created registry value successfully" end if ' Stop Netlogon service strService = "Netlogon" set objService = GetObject("WinMgmts:root/cimv2:Win32_Service.Name='" & _ strService & "'") if objService.StopService <> 0 then WScript.Echo "Error stopping " & strService & " service" else WScript.Echo "Stopped " & strService & " service successfully" end if ' Delete netlogon.dnb file On Error Resume Next set WshShell = CreateObject("WScript.Shell") set objFSO = CreateObject("Scripting.FileSystemObject") set objFile = objFSO.GetFile( _ WshShell.ExpandEnvironmentStrings("%systemroot%") _ & "\system32\config\netlogon.dnb") objFile.Delete if (Err.Number <> 0) then WScript.Echo "Error deleting netlogon.dnb: " & Err.Description else WScript.Echo "Deleted netlogon.dnb successfully" end if ' Start Netlogon service if objService.StartService <> 0 then WScript.Echo "Error starting " & strService & " service" else WScript.Echo "Started " & strService & " service successfully" end if WScript.Echo WScript.Echo "Done"
The procedure to disable registration of certain resource records is very similar to that described in Recipe 13.14 for preventing all records from being dynamically registered, except in this case, you need to create a value called DnsAvoidRegisterRecords under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters key. The type for DnsAvoidRegisterRecords should be REG_MULTI_SZ and the data should be a whitespace separated list of mnemonics. Mnemonics are used to represent various resource records that domain controllers register. The complete list of mnemonics is included in Table 13-3.
13.15.4 See Also
Recipe 13.14 for preventing all records from being dynamically registered, MS KB 246804 (How to Enable/Disable Windows 2000 Dynamic DNS Registrations), and MS KB 267855 (Problems with Many Domain Controllers with Active Directory Integrated DNS Zones)