Skip to content
IT // Adventures

Microsoft DHCP & secure dynamic DNS Updates

Workaround for DHCP/DNS warnings with event ID 8018 (DNS Client Events).

1 min read
Contents

Starting with Windows Server 2008, the Microsoft DHCP service can dynamically update DNS records for clients. This generally works quite well automatically, as long as (a) you only have a single DHCP server in use and (b) the DHCP service doesn’t run on a domain controller.

If multiple DHCP servers are operated within the same domain (e.g. for load balancing/failover), you need to adjust the security settings of the DHCP service.

Symptom

An indicator of the faulty configuration is the following entries in the event log of clients that frequently switch between LAN and Wi-Fi:

Event ID: 8018 Source: DNS Client Events

Fehler beim Registrieren der Hostressourceneinträge (A oder AAAA) für den Netzwerkadapter mit den folgenden Einstellungen:

    Adaptername: {... GUID ...}
    Hostname: <HOSTNAME>
    Primäres Domänensuffix: <DOMAIN>
    DNS-Serverliste:
    <SERVER 1>, <SERVER 2>, ... <SERVER N>
    Server, an den das Update gesendet wurde: <?>
    IP-Adresse(n) :
    <CLIENT IP ADDRESS>

Diese Ressourceneinträge konnten nicht registriert werden, weil der DNS-Server die Updateanforderung verweigert hat.
Mögliche Ursachen sind:
(a) Sie sind nicht dazu berechtigt den adapterspezifischen DNS-Domänenname zu aktualisieren.
(b) Der autoritative DNS-Server unterstützt das Protokoll für das dynamische DNS-Update nicht.

Solution

  1. Add all DHCP servers to the AD security group “DnsUpdateProxy”.
  2. In the properties of all DHCP services (on the “DNS” tab), enable the “Dynamic DNS updates” option and set it to “Always dynamically update DNS A and PTR records”.
  3. Also in the DHCP properties (on the “Advanced” tab), enter credentials for the dynamic DNS updates.
  4. If a DHCP service runs on a domain controller or “DHCP Name Protection” is enabled for a DHCP scope, the additional parameter “OpenAclOnProxyUpdates” must be set to 0 on the DNS servers. (see MS TechNet: The DNSupdateproxy group must be secured…)
  5. If DNS scavenging is enabled, the NoRefresh and Refresh values (added together) must be greater than the DHCP lease time.

Sources