Monday, May 27, 2013

The trouble with single label (Active Directory) domain names

Today on a domain of a client of mine (that has a single label Active Directory domain) i experienced a strange phenomenon
a new deployed client computers could not join a domain, the machine got the message An Active Directory domain controller for this domain could not be contacted

I went through all standard troubleshooting steps like:
  • Check local connectivity of the client
    • Hardware
    • Ipconfig
    • ping to the default gateway
  • Check name resolution
    • DNS
    • WINS
Everything looked ok but how could this be? next up were the servers, went through all tests on the domain controllers and services like DNS and DHCP, i found some faults but this were minor. coming to this point I got the impression I have overlooked something; but what?
Thing is: looking at a problem like this one troubleshooting should be started from the source. checking name resolution on the client revealed one interesting thing: the machine could find a machine.domainlabel but as soon as the Windows 7 client wanted to resolve the domain it could not find it...

You see when using a single label domain you normally enter a domain like domain.local but with a single label domain name you enter domain doing this triggers a client to use NETBIOS name resolution! after checking the DHCP I found the fault. the first WINS server stated in DHCP pointed to a server on which a day earlier the WINS was uninstalled. after installing WINS and enabling Use WINS forward lookup everything worked as normal.

this calls for one conclusion: the main problem with single label domain names is that it triggers clients to use WINS name resolution is a number of cases. since all modern AD integrated software uses DNS name resolution a lot of things in these programs probably will falter.

till next time.