Windows Tip Sheet

Home Sweet Home Home Home

If you're crazy enough to connect your multihomed DC to a DMZ, here's how to do it.

Multihomed domain controllers can be tricky beasts. I recently had a client who -- for reasons I won’t go into -- had a multihomed DC connected to both their intranet and to a DMZ. The DMZ, of course, was separated from the intranet by a firewall. Half the time you tried to contact this DC, your connection would fail, which created a great many logon issues.

The problem, of course, is that the DC was registering both its interfaces with DNS, but one of those interfaces -- the one hooked up to the DMZ -- wasn’t reachable by clients on the appropriate ports. Obviously, hooking a DC up to anything but your intranet is probably asking for trouble of some kind, but the connectivity issue can be resolved by disabling DNS registration on the DMZ-connected network adapter. You’ll find this in the TCP/IP properties of the appropriate adapter, on the Advanced tab. Once the DC stops registering the unreachable IP address in DNS, clients will start using only the reachable adapter, and all will be well.

Of course, I don’t need to detail the potential dangers of having your company’s security database connected to something like a DMZ or the Internet -- so proceed with caution!!

More Resources

  • Microsoft has something to say about multihomed DCs here.
  • Smaller businesses may do something like install ISA Server on a DC, which leads to the problem I’ve described. Here’s how to do it properly.
  • This is hardly a new problem: Here’s a blast from the past discussing multihomed browser issues in the NT 4 world. Remember?

Micro-Tips
One way to create a multihomed DC without realizing it is in virtual computing environments like VMware or Virtual PC; because it’s so easy to create virtual machines that have multiple adapters, you may not realize you’ve created a multihomed DC at all. Be sure to carefully review your virtual machines’ network configuration, since an improper configuration can make the virtual DC impossible to reach, or at least inconsistent.

About the Author

Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is an Author/Evangelist for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.

comments powered by Disqus
Most   Popular

SharePoint Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.