Change SOA Record

The following illustrates on how to change SOA record.

1. Assume the domain is "myrootdns2003.com" and dns server is "dnssserver2003".
2. Open dns using the command dnsmgmt.msc.
3. In the console tree, browse to dns zone "myrootdns2003.com", right click on it and select properties.
4. In dns zone properties dialog, go to "Start Of Authority(SOA)" tab, enter the FQDN of primary dns server "dnsserver2003", responsible person and serial number as shown below.
5. Thus changes the SOA record on domain controller.

Create SRV record

Service (SRV) record. Allows administrators to use several servers for a single DNS domain, to easily move a TCP/IP service from one host to another host with administration, and to designate some service provider hosts as primary servers for a service and other hosts as backups. DNS clients that use a SRV-type query ask for a specific TCP/IP service and protocol mapped to a specific DNS domain and receive the names of any available servers.

The following shows on how to create SRV record

1. Assume the dns server is "dnsserver2003" and dns zone to which the srv record to be added is "myrootdns2003.com"
2. Open dns management snap-in console using the command dnsmgmt.msc.
3. In the console tree, go to the dns zone "myrootdns2003.com", right click on it and select "other new records"
4. Select "Service Location (SRV)" in new resource record type dialog and click "Create Record" button.
5. Enter the SRV server details in new resource record dialog, and select "Allow any authenticated user to update all dns records with the same name" check box and click ok.
6. Thus creates new srv record.

Netdom - Verify Trust

It is often needed to verify a trust relationship, particularly external trust relationship, is working properly before using any cross domain network resources. To verify a trust on command line. do the following.



1. Assume the trusting and trusted domains are "myrootdns2003.com" and "myforesttest.com" respectively and passwords are "Mydns123" and "Myforest123".
2. Now run the below command to verify the external trust.



netdom trust myrootdns2003.com /domain:myforesttest.com
/userd:myforesttest\Administrator /Passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /verify




3. To verify trust relationship between Active Directory based windows domain and non-windows realm kerberos domain (Assume the kerberos realm password is "Mytrust123"), run

netdom trust myrootdns2003.com /domain:myforesttest.com
/userd:myforesttest\Administrator /Passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /verify /Passwordt:Mytrust123

reset trust relationship

When a trust relationship is broken, then it is necessary to reset the trust relationship. The following illustrates on how to reset a broken domain trust relationship.

1. Assume the trusting domain name is "myrootdns2003.com" and trusted domain is "myforesttest.com".
2. Open "Active Directory domains and trusts" Console diagram using the command "domain.msc".
3. Right click on domain node "myrootdns2003.com" and select properties.
4. In "myrootdns2003.com" properties dialog, select the domain "myforesttest.com" and click properties. 5. Click validate button in "myforesttest.com" properties dialog.
6. If validation fails, a dialog box comes to reset the trust relationship. Then follow up with the dialog box and complete the resetting.

netdom - reset trust

If a trust relationship between two domain is broken, then it is necessary to reset the trust. netdom.exe is a command tool which can be used to reset the trust. Follow the steps below to reset the trust.

1. Assume the trust exists between the domains "myrootdns2003.com" and "myforesttest.com". Passwords of both the domains are "Mydns123" and "Myforest123" respectively.

2. Now run the below command to reset trust.

netdom trust myrootdns2003.com /domain:myforesttest.com /userd:myforesttest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /reset


3. If the trust is between windows domain and non-windows realm (kerberos) , then run the below command to reset the trust,

netdom trust myrootdns2003.com /domain:myforesttest.com /userd:myforesttest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\Administrator /passwordo:Mydns123 /reset /Passwordt:Mytrust123

Note, the passwordt has to be provided to reset the trust with Kerber0s realm.

Register SRV Record

By Default, SRV records are automatically created one the domain controller is installed.
If srv records not found or invalid, try the following mitigation to manually register dns srv records.

1. Restart NetLogon server on domain controller (DC).
2. If step 1 fails, then run dcdiag /fix and check srv records are registered.
3. if both 1 and 2 fails, run netdiag /fix on domain controller.
4. if , 2 and 3 fails, then try manually editing netlogon.dns. i.e add srv record to netlogin.dns as shown below.
After editing the netlogon.dns file, reload the dns zone as shown below.

If none of the above works, still one can register srv records, by recreating dns zone. Follow the instructions shown below to recreate dns zone.

1. Assume the dns zone is "myrootdns2003.com"
2. Open dns management console using dnsmgmt.msc command.
3. In the dns console tree, go to forward lookup zones, right click on dns zone. "myrootdns2003.com" and click delete.

4.After deleting dns zone, right click on "forward lookup zones" and select "newzone" and follow the steps to recreate same dns zone. i.e dns zone with name "myrootdns2003.com"
5. while re creating new zone, “Allow Secure and Non Secure Dynamic updates" option in dynamic updates dialog.
6.Now restart netlogon service.

Add NS Record

NS record is also called as Name Server record. To Add NS record to a dns, do the following.

1. Assume the dns server for the domain "myrootdns2003.com" is "dnsserver2003".
2. To open dns manager snap-in, run the dnsmgmt.msc command on dns server "dnsserver2003".
3. In console tree, traverse to the dns zone "myrootdns2003.com", right click on zone and select properties.
4. Go to the Name Servers tab in properties dialog and click Add Button.
5. Now enter the FQDN of the name server "dnsserver2003.myrootdns2003.com" in Name Server text box and click resolve in resource record dialog.
6. Verify the name server is resolved to its ip address "192.168.1.100" and click ok.
7. Verify the name server is added to name server dialog, click apply and then click OK.

Delete dns record

To remove a dns resorce record, follow the instructions shown below.

1. Assume the domain dns zone is "myrootdns2003.com", dns server is "mydnsserver2003".
2. Open dns management console using the command dnsmgmt.msc.
3. In dns manager console window, browse to the dns zone "myrootdns2003.com", click it, see the list dns records in the right pane, select the desired dns record to removed, right click on it and select "delete".

manage trust using netdom

Netdom.exe is a tool which is used for managing domain workstations in a domain and trust relationships between domains.
This post discusses on adding,removing and managing trusts between domains(forests).

To Create an external trust (External trust is a trust relationship between domains of different forests):

External trust can also defined as a trust between an active directory(AD)domain to Windows NT Domain or to external forest is called external trust. Follow the instructions shown below to add external trust from AD domain to forest or Windows NT domain.

1. First, assume the trusting domain is "myrootdns2003.com", trusted domain is "mytestforest.com", trusting domain administrator password is "Mydns123" and trusted domain(forest) administrator password is "Myforest123".

2. Now run the simple command shown below to add trust from "myrootdns2003.com" to "mytestforest.com".

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123 /add

Output:To improve the security of this external trust, security identifier (SID)filtering is enabled. However, if users have been migrated to the trusteddomain and their SID histories have been preserved, you may choose to turnoff this feature.
For more information about SID filtering and how to turn it off, see the helpfor netdom trust /FilterSids or see Help and Support.
The command completed successfully.

Suppose if you want to provide trusting domain passwords along with the trusted domain password, which is needed in a situation like creating trust from a remote machine, to create trust, then run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123
/usero:myrootdns2003\Administrator /passwordo:Mydns123 /add

If you can also create trust without passing passwords by running the command below

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /add

In the above, passwords will be asked interactive for making connections with trusting and trusted domains.

All the above created trusts are one way trust. This is because, By default trust between two domains of different forests is one-way. However a two-way external trust can be created with the option /two-way. See below

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /add /two-way


The /Quarantine option is used to Set the domain quarantine attribute in an exiting trust. i.e if it is "yes", then only SIDs from the directly trusted domain will be accepted for authorization. SIDS from any other domains will be removed. Specifying /Quarantine without yes or no will display the current state.
To set Quarantine for an existing trust, run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes"

To list routed name suffixes in an exiting external trust, then run

netdom trust myrootdns2003.com /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes" /NameSuffixes:mytestforest.com

Note: 1. trust name is "mytestforest.com" from trusting domain "myrootdns2003.com"
2. /Domain option is not required
3. One find trust name using the command netdom query as shown below.

netdom query /domain:myrootdns2003.com /userD:myrootdns2003\Administrator /passwordd:* trust

To change the status of a routed name suffix of a trust, then do run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /Quarantine:"yes" /ToggleSuffix:1 /NameSuffixes:mytestforest.com

Here the no#1 specifies the first name suffix status to be changed.

To allows users migrated to the trusted forest from other forest to access resources in this forest using SID history, run

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /EnableSIDHistory:"yes"

Bydefault, disables migrated users in the trusted forest to use SID history to access resources in this forest.

To specify selective authentication across the external trust, then run

netdom trust myrootdns2003.com /domain:mytestforest.com /userD:mytestforest\Administrator /passwordd:*
/usero:myrootdns2003\administrator /passwordo:* /SelectiveAUTH:"yes"

To create with a non-Windows Kerberos realm, run (Assume the target non-windows kerberos domin is mytestforest.com)

netdom trust myrootdns2003.com /domain:mytestforest.com
/userD:mytestforest\Administrator /passwordd:Myforest123
/usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass"

Here /PasswordT is the New trust password needed for windows domains to make any changes, updates or resets made to this trust.
To allow the external trust to be created for only one of the domains, then run trust create command wiht /oneside option.

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass" /oneside:trusted

Thus the above allows the trust to be created or remove for "trusted domain" only.

To specify the Kerberos authentication protocol should be verified between windows and non-windows domains, run

netdom trust myrootdns2003.com /domain:mytestforest.com

/userD:mytestforest\Administrator /passwordd:Myforest123 /usero:myrootdns2003\administrator /passwordo:Mydns123 /add /REAlm /PasswordT:"mytrustpass" /Kerberos

To remove the trust, just run the below command

netdom trust myrootdns2003.com /domain:mytestforest.com /userD:mytestforest\ Administrator /passwordd:* /usero:myrootdns2003\administrator /passwordo:* /remove

Domain trust

A domain trust is a relationship between domains which allows users of one domain to access services of other domain.

By default, users of a domain can have access to resources contained in that domain. i.e domain users can use domain resources like network printer, fax service and any network share. However, users of one domain cannot access resources of other domain. By this way, a domain can provide its users with secured access to all resources in that domain. If all users accounts and services can be managed in a single large domain, then there is no problem. However, there are needs to have multiple separate domains. This is because having multiple domains is a useful way to separate the scope of each domain administrator from other domain administrators. i.e Each domain administrator is responsible for setting up scope of security policy and account policy settings on domain users and domain resources. Thus both multiple domain and trusts between domains are needed.

Trust mechanism in windows

A domain trust(trust relationship) is a relationship between two domains to allow authentication and authorization to shared resources. In authentication process, verifies the user identity and in authorization process determines what the authenticated user is allowed to do on shared network resource on target computer. i.e Once the user is authenticated by the domain containing shared network resource, the target computer compares the user’s credentials to the permissions assigned within its security descriptor table to help determine the user’s level of authorization to the shared resource. A security descriptor table contains access control lists (ACLs) that identify the users and groups that are assigned or denied access permissions on shared resource.

Trusts in Active Directory:

Domains that have domain controllers running Windows 2000 Server or Windows Server 2003 used Active Directory service. Windows NT and earlier windows versions doesn't have active directory service support.

Trust Relationship types:

The direction that a trust is assigned determines the trust path used for authentication. A trust path is defined by the series of trust relationships that authentication requests must follow between domains.

The following are the domain trust relationship types characterized by the trust path used for authentication.

One-Way Trust
A one-way trust is a unidirectional trust between two domains. i.e in one-way trust between a trusted domain and a trusting domain, trusted domain users or computers can access resources in the trusting domain. However, the trusting domain users cannot access resources in the trusted domain. Some one-way trusts can be either nontransitive or transitive, depending on the type of trust being created.
Two-Way Trust
A two-way trust is a bidirectional trust between two domains. i.e users of either domain can send authentication requests to other domain. Some two-way relationships can be either nontransitive or transitive depending on the type of trust being created.

All domain trusts in an Active Directory integrated forest are two-way, transitive trusts. When a new child domain is created, a two-way, transitive trust is automatically created between the new child domain and the parent domain. This is not true with domains not integrated with active directory service(windows NT and earlier versions).

Trust Transitivity
Transitivity determines whether a trust between two domains can be extended beyond the two domains. A transitive trust extends trust relationships to other domains. Every time a domain created in a forest, a two-way transitive trust is created between the new domain and its parent domain automatically. The trust path flows upward through the domain hierarchy, extending the initial trust path created between the new domain and its parent.

Transitive trust relationships thus flow upward through a domain tree. Therefore a domain tree can be defined as a hierarchical structure of one or more domains, connected by transitive, bidirectional trusts, that forms a contiguous namespace.

So with transitive trusts, user accounts of any domain in the forest can be authenticated by any other domain in the forest. Consequently, with a single logon process, accounts with the proper permissions can access resources in any domain in the forest happens.

Nontransitive trust
In this, The flow is restricted to the two domains in the trust relationship and nontransitive trust does not extend trust relationships to other domains in the forest. A nontransitive trust can be either a two-way trust or a one-way trust. By default, Nontranstive Trusts are not created. On must explicitly create those.

Various Trust Deployment methodologies

There are three trust deployment strategies that are used to accommodate the resource sharing needs of an enterprise. These are intra-forest, inter-forest and Kerberos realms based trusts.

Intra Forest Trusts

Intra-forest trusts are transitive trusts that can be used only within a single forest. i.e trust can't be created across multiple forests. Intra-forest trusts includes tree-root, parent-child, and shortcut trust relationships.

Tree-root trusts

By default, two-way, transitive trusts are automatically created when a new domain is added to a domain tree or forest root domain. But when a new domain tree is created in an existing forest, then a new tree-root trust is established. tree-root trusts are two-way and transitive.

Parent-child trusts

A new parent and child trust is established when ever a new child domain is created in a domain tree. Trust flows from child domain to parent domain and goes upwards till domain tree.

Shortcut trusts

Shortcut trusts are the trusts established between two domain trees within the same forest. By Default, Authentication requests must first travel a trust path between domain trees, and in a complex forest this can take time. Using shortcut trusts can create trust with domains in other domain trees. Thus authentication requests goes through shortcut trust which increases overall speed.

Inter Forest Trusts

Inter-forest trusts can be created between domains contained in different forests. Inter-forest trusts can be nontransitive or transitive. Inter-forest trusts include external trusts and forest trusts and both these trust types should be created explicitly.

External trusts

External trusts are nontransitive which can be created between domains in different forests or between an Active Directory domain and a Windows NT 4.0 domain.

Forest trusts

Forest trust is a trust relationship between two forests. Forest trusts can be a one-way or two-way transitive. A two-way forest trust is used to form a transitive trust relationship between every domain in both forests. Forest trusts can be created only between two Windows Server 2003 forests and cannot be implicitly extended to a third forest.

Kerberos Realm Trusts

A realm trust can be established between any non-Windows-based operating system Kerberos version 5 realm and a Windows 2000 or Windows 2003 domain. This trust relationship allows cross-platform interoperability with security services based on other Kerberos version 5 implementations. Realm trusts can be either one-way or two-way.

Clear dns client cache

To delete staled or expired dns entries at a dnsclient, run the following command on dns client machine

ipconfig /flushdns

Note: Cleaning Dns Server cache is different. To clear cache at server side go to Flush server side cache

import zone from a file

To import a zone from a .dns file, do the following

1.Assume the dns server is "dnssever2003" and the zone to be created is "myrootdns2003.com".
2. Open dns manger snap-in using the command dnsmgmt.msc.
3. In the console tree, traverse to the forward lookup zone, right click on it and select "newzone".
2. Click next in new zone wizard

5. Select "primary" if one wishes to create Primary zone or select secondary zone or stub zone and then click next.


6. Enter zone name "myrootdn2003.com" in zone name dialog and click next.
8. Enter zone file "myrootdns2003.com.dns" from which to load zone om zone file dialog and click next.

9. Select "Do not allow dynamic updates" in dynamic updates dialog and click next.
9. Verify the final settings in the summary dialog and click finish.

import reverselookup zone from file

To import a reverselookzone from a file, follow the instructions shown below.

1. Assume the dns server is "dnsserver2003" and reverse lookup zone is "1.168.192.in-addr.arpa"
2. Open dns manger snap-in using the command dnsmgmt.msc.

3. In the console tree, browse to reverse lookup zone, right click on it and select "newzone" and click next
4. Click next in zone wizard

3. Select "primary" if one wishes to create Primary zone or else select secondary zone or stub zone and then click next.

5. Select "all dns servers in the active directory domain myrootdns2003.com" in zone replication scope dialog and click next.
6. Enter the network id "192.168.1" in reverse lookup zone name dialog and click next.7. Select "Use the existing file" option and enter "1.168.192.in-addr.arpa.dns" in zone file dialog and click next. Make sure the file "1.168.192.in-addr.arpa.dns" exists at %windir%\system32\dns
7. Select "Do Not allow dynamic updates" in dynamic updates dialog and click next.
8. Verify the settings in summary dialog and click next.

Export reverse lookup zone using dnscmd

Do the following to export reverse lookup zone on command line. 1. Assume the primary dns server for the dns (domain controller) is "dnsserver2003" and the reverselookupzone file to be created is "reverselookupzone.dns"
2. Now run the below command to export reverselookup zone on command prompt.

dnscmd dnsserver2003 /zoneexport 1.168.192.in-addr.arpa reverselookupzone.dns.

Output: DNS Server . exported zone 1.168.192.in-addr.arpa to file C:\WINDOWS\system32\dns\reverselookupzone.dns Command completed successfully.

3. To export the zone from current cache, then run
dnscmd /zoneexport 1.168.192.in-addr.arpa /cache

output:DNS Server . exported zone
1.168.192.in-addr.arpa to file C:\WINDOWS\system32\dns\/cache
Command completed successfully.

Export reverse lookup zone

The following illustrates exporting reverselookup zone to a file,
1. Assume the dns server for domain "myrootdns2003.com" is "dnsserver2003"
2. Open dns manger snap-in using the command dnsmgmt.msc.

3. in the console tree, browse to the reverse lookup zone, right click on it and select "export list".
3. Enter the file name to which the zone to be exported in save dialog box.
Relevant Posts:
Export reverse lookup zone on command line
Create Reverse Lookup zone from file

How to Join a domain

To join a machine to a domain, follow the instructions shown below.
1. Assume the domain to which this machine going to be joined is "myrootdns2003.com".
2. Open mycomputer, right click on it and select properties.
3. In mycomputer properties, go to Computer Name tab, click on "change" button.
4. Enter domain name "myrootdns2003.com" in to which this machine will join in Compute Name Changes dialog and click ok.

5. Enter user name and password which has privileges to join in target domain and click ok.
6. Thus domain join success pop up dialog comes up.Relevant Posts:
Join a target domain on command line

Enable Secure and NonSecure updates on a zone

To enable both the secure and non secure updates on a zone follow the instructions below.

1. Assume dns server which is acting as a domain controller(DC) for a dns say "myrootdns2003.com" is "dnsserver2003", zone name on which to enable secure/nonsecure updates in "myrootdns2003.com".
2. Open dns management console using the command dnsmgmt.msc
3. In the console tree, browse to the dns zone "myrootdns2003.com", right click on it and select "properties".
4. In the dns zone properties dialog, go to general tab, select "nonSecure and Secure" option in the dynamic updates drop down box.

Enable Secure DynamicUpdates on reverselookup zone

Follow the instruction below to enable secureupdates on a reverselookup zone.

1. Assume the dns server on which the DNS (DomainController) is installed is "dnsserver2003" and reverse lookup zone is "1.168.192.in-addr.arpa".
2. open the dns management console snapin using the command dnsmgmt.msc.


3. In the console tree, browse to the reverse lookup zone, right click on it and click "properties"
tr>3. In the reverse lookup zone properties dialog, go to the general tab and select "secure only" option from Dynamic updates drop down box, click apply and then click ok button.