The DNS SRV test fails for Domain Controllers that only register site specific SRV records (4235125)

The DNS SRV test fails for Domain Controllers that only register site specific SRV records

Some DCs (such as branch DCs) only register site specific DNS SRV records (as per Microsoft best practice). This is reflected in the local netlogon.dns file. Because generic records (e.g. _kerberos._tcp.dc._msdcs.DOMAINNAME) are not registered on branch office Domain Controllers, Active Administrator for Active Directory Health generates the following critical alerts: “One or more requisite DNS SRV (Service Locater) entries are not defined” Can the health test be changed to just check for the SRV records that need to be registered for the branch DCs.

When querying for the DC SRV records, AA takes the primary DNS server for the machine it is monitoring and attempts to query the SRV record for the domain controller. If there is a secondary DNS server set it will also query it.

WORKAROUND:

If needed, the test or alert can be disabled per DC:

1. Open the AA console
2. Expand Active Directory Health
3. Select Agents
4. From the list of Agents, right click a branch DC that you want to disable the test or alert for and select Alert Settings | Domain Controllers to disable the alert or Data Collectors | Domain controllers to disable the test
5. Scroll down, right click Missing domain controller SRV DNS record (or Missing SRV DNS record for either the primary or secondary for the Alerts), select Properties and uncheck Enabled

STATUS:

An Enhancement Request (VSTS010144) to have the test compare the Netlogon.dns file to DNS has been submitted to Development for consideration in a future release of Active Administrator.

VSTS010144