BPA: Error DNS: Zone _msdcs.domain.com is an Active Directory integrated DNS Zone and must be available.

---

Hi,

on our DCs the BPA comes up the the error in the subject.

From what I understand this is because this is an old domain and meanwhile you store the _msdcs.domain.com zone directly under "Forward Lookup Zones" and not only at the "zone name" as we old folks learned. I get why and now want to fix this.

It would be great if someone could double check the way I consider to do this:

1. I delete the _msdcs.domain.com folder folder under domain.com
2. I add a new primary zone "_msdcs.domain.com" directly under at the Forward Lookup Zones
3. This Zone will be available for all DCs in the forrest and I will allow only secure updates
4. Now I would restart Netlogon & DNSServer service
5. Delete local cache: ipconfig /flushdns
6. Log into all other DCs, restart DNS & Netlogon Service and delete Cache.

Is this how it is done? Do I have to prepare anything else? Do I have to delete the DNS entries of the DCs?

Edit: And another question: What happens when I restart DNS & Netlogon Service. How much impact is this for the user?

Additional question: my _msdcs folder contains some entries of the same DC in upper AND in lower case.. is there an explanation why this happens? the timestamps are different for this entries.

Thanks.
s.

Shifty,

I hope all is well. The following, although old, will walk you through the steps and help you to validate your approach.

https://support.microsoft.com/en-us/help/817470/how-to-reconfigure-an-msdcs-subdomain-to-a-forest-wide-dns-application

You are on the right track. Let me know if you have questions after you take a look.

Cheers,

Adam