question

saikiranreddy-7940 avatar image
0 Votes"
saikiranreddy-7940 asked saikiranreddy-7940 commented

Split Brain Configuration on Windows Server 2016

Hi,

I am trying to do Split Brain set up on Windows Server 2016. I have an user credentials who belongs to DNSAdmins. This user is not able to add the Split Brian configuration like add zone scope or resolution policy.

I see following error when I try to add zone scope.

PS C:\Users\kirant> Add-DnsServerZoneScope -ZoneName apple.com -Name anyScope -verbose

VERBOSE: The scope anyScope will be added for the zone apple.com on server WIN-MSSIRD3QRBS.

Add-DnsServerZoneScope : Failed to add scope anyScope to zone apple.com on the server WIN-MSSIRD3QRBS.

At line:1 char:2

  • Add-DnsServerZoneScope -ZoneName apple.com -Name anyScope -verbos ...

  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    • CategoryInfo : InvalidOperation: (apple.com:root/Microsoft/...ServerZoneScope) [Add-DnsServerZoneScope]

    , CimException

    • FullyQualifiedErrorId : WIN32 1013,Add-DnsServerZoneScope

But when I add this user to the Domain Admins who is the member of Administrators then the user is able to perform Split Brain configuration. The issue here is I don't want to give Administrators privileges to the user. I have been trying multiple combinations of privileges but no luck.

What are the least privileges required for an user to perform Split Brain configuration?

Thanks

windows-serverwindows-server-powershellwindows-server-2016
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LimitlessTechnology-2700 avatar image
0 Votes"
LimitlessTechnology-2700 answered saikiranreddy-7940 commented

Hi there,

The least privilege required for a user to perform Split Brain configuration is the Admin privilege. When creating a DNS policy to implement split-brain DNS, you need to first configure DNS zone scopes with one zone scope containing the host records that should be returned to an external client and another DNS zone scope containing host records that should be returned to internal clients. This need can be done only by the Domain admin

Windows Server 101: Configuring Split-Brain DNS on Windows Server
https://techcommunity.microsoft.com/t5/itops-talk-blog/windows-server-101-configuring-split-brain-dns-on-windows-server/ba-p/359726.



--If the reply is helpful, please Upvote and Accept it as an answer--

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Apologies for the late reply. If Domain Admins is needed to manage Split Brain, then that is the answer I needed. If there is any link or document that can support this statement it would be really helpful. Thanks.

0 Votes 0 ·
DSPatrick avatar image
0 Votes"
DSPatrick answered saikiranreddy-7940 commented

You can follow along here.
https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/split-brain-dns-deployment

--please don't forget to upvote and Accept as answer if the reply is helpful--



· 7
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for the reply. I have gone through the link you shared. It does not answer my question. What are the privileges needed for any user to configure Split Brain on Windows Server?

0 Votes 0 ·
DSPatrick avatar image DSPatrick saikiranreddy-7940 ·

I'd expect that the domain admins would handle this task.

--please don't forget to upvote and Accept as answer if the reply is helpful--



0 Votes 0 ·
DSPatrick avatar image DSPatrick saikiranreddy-7940 ·

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--



0 Votes 0 ·

Apologies for the late reply. If Domain Admins is needed to manage Split Brain, then that is the answer I needed. If there is any link or document that can support this statement it would be really helpful. Thanks.

0 Votes 0 ·
Show more comments