[Autogenerated] Welcome back.
Let's get into the nitty gritty of DNS zones using PowerShell.
First up is zone creation with PowerShell.
You can create a DNS zone with a symbol command like new DNS server,
primary zone.
This command will allocate a new zone and you can even specify properties like
the zone file name or whether it should be a integrated.
Next, we have a new running zone.
This is where you can see all of your current zones,
use the G DNS server zone Compal here to list them all.
It's essential to keep an eye on this.
Lastly for zone deletion.
It's as straightforward as using a removed DNS server zone.
We'll cover all of this in the demo.
Now, let's talk about DNS forwarders.
These are essentially DNS servers that your server will query when it can't
resolve the domain name locally to create forwarders.
You'll use the A DNS server forwarder command and the add DNS
server conditional forwarder zone command.
If you're interested in in querying the existing forwarders,
you can use the G DNS server forwarder command.
This will show you the IP addresses and then be server currently
forwarding to time for a new demo in this demo,
we're going to cover setting up and managing your server
dns forwards and conditional forwarders.
We'll run through the entire process from the client
perspective to give you an overall understanding of how
forwarders work and how to manage them.
So let's dive right in.
I'm here in my Windows, 10 machine connected to my actual directory domain.
And let's first create a DNS forward.
A DNS forwarder is a DNS server on a network used to forward all
locally unresolvable DNS queries to another DNS server.
So let's say that I don't know all of our clients are using the
SRV one server as a DNS server or 10.0 0.0 0.4.
So let's let me go ahead and confirm that first.
So running get DNS client server address on the Windows.
10 client will show me all of the DNS servers that this
Windows 10 client is using for name resolution.
So look good because the first Ethernet adapter there is 10.0 0.0 0.4.
So it is pointing to my SV one server.
Now, let's verify the domain on this local computer here.
I'm getting a little fancy by querying a .NET class directly
called system .NET dot DNS and using its G host by name method
to query the fully qualified DS name,
this line returns the host and the domain name.
So I can see the domain name is PS versus MN dot local.
Great all right.
So this client is in the PS four SM MS local domain,
which means its domain controller.
SRV one is set up with that zone.
I should now be able to query any host in that domain without any trouble
since his client is pointing to that SB one server.
So let's try that out.
Looks good.
Now,
I want all DNS traffic destined for the SRV one server that's not
for a record in that authoritative domains.
PS versus dot local zone.
I want all that traffic to forward over to another
server on my network called SRV two.
Now,
I've set up a zone called internal service dot local
on that two server ahead of time.
So let me first confirm that the SRP one server this client is
using cannot resolve this domain and as expected,
it fails, it fails because SRV one doesn't know where that zone is.
Now, let's add a forwarder to forward all traffic for.
Now, from that SRV, one server doesn't know about to the SRV two server.
Now, to do that,
I'll need to run a command on the SRV one server where
my DNS server module is installed.
Now,
I'm using power shower moting in volt command to run a
single command on the SRV one server here.
I'm running add DNS server forwarder and adding the DNS server
of the SRV two server which is 10.0 0.0 0.5.
OK.
No errors.
That's always a good thing.
Now, the DNS server forwarder should now be set up on SRV one.
Let's try that query again from my local client.
Hey, it works.
SR A one didn't have the internal service dot local zone.
So we forwarded that request to the SRV two server which did and it returned
the response to the client as you can see here as expected.
So the DS server forwarder forward all the external
queries to the SRV two server.
But what if you just want a single domain?
Well, to do that, you need to use a conditional forwarder zone.
But first,
let me remove that general server forward and confirm it's not resolving again.
And this time,
I'll just open up an interactive PowerShell remoting session into SRB one.
And i'll confirm that DNS server forwarder exists with G DS server forwarder.
Yep, it's there.
Now, I can pipe that output to remove DNS server forward to remove it.
I'm fine with a warning.
So, yes, now my client resolution should fail again.
So let me confirm that by coming back to my client and
then I'll try that resolution again.
It's still working.
I bet the server is caching the response.
So let me clear the server cache by running the clear DNS server
cache command on that SRV One server clear DNS over cache can't
be any more descriptive than that.
Yes.
All right.
So the DNS server cache on SRV one has been cleared.
Now, let's try that resolution again and there we go.
It's now failing again as it should.
Now let's add a conditional forwarder which will only forward DNS queries
for internal servers dot local to the SRV two server.
So to do that, I will remote in to my SRV one server again.
And then I will add the conditional forwarder,
add server DS conditional forward zone and then it's setting the master server,
which is the server that it will forward it to,
which is 10 to 00 to five, which is my SRV two server.
Now, now that that condition of order should now be in place.
Lets confirm whenever you create a conditional forward,
it technically creates a server zone on the server that's doing the forwarding.
Now notice the zone type is forwarder that
designates that it is a forwarder zone.
Now I'll come back to my client again and then I'll
try that resolution request again.
Hey, it works.
SRV One is only forwarding requests for host in the internal
service dot local zone to the SRV two server.
Now, let's wrap this up by cleaning up our mess.
Let's come back to the SRV one server again.
And now I will remove that conditional forward zone F and
our conditional forward is now gone.
And there you have it,
you've just learned how to create server and conditional DNS
forwards on your actor directory domains,
DNS servers and how to remove the server forwarders
when they're no longer needed.