Editor's Note: Share your Windows 2000 and .NET discoveries, comments, problems, solutions, and experiences with products and reach out to other Windows & .NET Magazine readers (including Microsoft). Email your contributions (400 words or less) to [email protected]. Please include your phone number. We edit submissions for style, grammar, and length. If we print your submission, you'll get $100. Submissions and listings are available online at http://www.winnetmag.com/articles. Enter the InstantDoc ID number in the InstantDoc ID text box.
Warning About Mass Win2K DNS Edits
In Reader to Reader: "Mass Win2K DNS Edits," August 2001, Craig Matthews makes an excellent point in his commentary about the Microsoft Management Console (MMC) DNS snap-in's limitations. The snap-in doesn't work well for performing the type of large-scale functions necessary when you administer DNS. Craig explains the alternative method he used to make mass edits of Active Directory (AD)—integrated DNS zones. But before you emulate his method of changing your DNS server from Active Directory—Integrated to Standard Primary and back to Active Directory—Integrated, you need to be aware of the pitfalls.
Craig's solution is useful only if you have a huge number of changes to make in a one-time task, such as a mass migration to dynamic DNS (DDNS). His method isn't ideal for typical large-scale record manipulation.
Although Craig's method will likely work for a small-scale implementation or in a site with only one DNS server, you might encounter problems if you have multiple DNS servers, possibly spread around the world in different AD sites and using various replication schedules. When you deintegrate the DNS zone, you're likely to experience large DNS outages. When you reintegrate the DNS zone, you'll generate excessive replication traffic across potentially slow or already taxed WAN links.
When you make an integrated zone a primary zone, the server on which you performed this action becomes the standard primary DNS server for that zone. After replication occurs, other DNS servers, which previously loaded that zone from AD, will be unable to load the zone. Until you complete your edits and reintegrate the zone, you will have only one operational DNS server. Replication then needs to be completed throughout the infrastructure, and the other DNS servers need to reload the zone. When you reintegrate the zone and replication occurs, all the objects (i.e., records) that make up the DNS zone will need to replicate to all the DNS servers again. This process could be lengthy over slow or saturated WAN links. The total outage might be several hours, especially in a large organization. To prevent the DNS zone from being unavailable for an extended period of time, you must ensure that the entire process fits within one replication interval. However, many companies have replication turned up to every 15 minutes. Unless the systems administrator changes this interval, the zone deintegration will replicate across the site and potentially across other sites in the enterprise.
Alternatively, you can use simple shell scripting and the Dnscmd command-line utility (from the Windows 2000 Server CD-ROM) to handle mass DNS edits and avoid these risks. Use a text file that contains the nodes you want to delete (i.e., deletenodes.txt), and run the following command from the command line:
for /f %i in (deletenodes.txt) do (dnscmd <mydnsserver> /nodedelete <myzone.com> %i /f)
To use this command in a batch script, replace %i with %%i.
If you don't have a list of the nodes you want to delete, you can use the MMC DNS snap-in to export your DNS zone. Right-click the zone and select Export List. Then, edit the file to include only the nodes you want to delete. Be sure to use one line per node and to use the zone name, which the command requires, rather than the Fully Qualified Domain Name (FQDN).
You might want to limit your activity to a DNS server that isn't bogged down and that's at a core AD site, to decrease replication latency. To minimize the effect, schedule the command to run at night. You can use a similar approach to add records in bulk. You need only change the Dnscmd command.
