Group Policy not updating when migrating to Pi-Hole DNS
reddit / selfhosted

----------------------------------------------------------------------
the1corrupted · 2023-12-03 10:53

Hello, everyone.

I am trying to migrate from Microsoft DNS that's currently on two of
my domain controllers. I have made a config file for all the SRV
records I could possibly find (also thanks to Pi-Hole and their
excellent query log) I have, through combination of reverse-engineer
and internet searching compiled a list of SRV records that SHOULD be
connecting my test host to the existing domain but use Pi-Hole as the
in-between DNS.

I have used NSLOOKUP on the test machine to make sure that the SRV
records are in fact resolving.

Every time I run gpupdate, it states that it cannot communicate with a
domain controller.

I am not sure how this might matter, but here's the current layout

|Windows 10 test host >|Pi Hole >|Domain controller 1 (that has DNS
installed/running)|
|:-|:-|:-|
|||Domain controller 2 (that has DNS  installed/running)|

So what should be happening is the test host gets all the LDAP records
from Pi-Hole and gets to the DC. I think that Microsoft DNS might be
throwing a wrench at me, but I am really not sure.

I made a custom dnsmasq conf file that might be over-engineered, or
not but basically it came about because I saw my test machine making
an outbound query, and then I mirrored it on the Pi Hole DNS. So I
think this is the most complete list of SRV records for Windows 10 and
Server 2022.

Some of these I found on a [blog article from
2014](https://blog.delouw.ch/2014/03/26/providing-srv-and-txt-records-
for-kerberos-and-ldap-with-dnsmasq/).

    srv-host=_ldap._tcp.[MYDOMAIN],dc01.[MYDOMAIN],389,1
    srv-host=_ldap._tcp.[MYDOMAIN],dc02.[MYDOMAIN],389,2
    srv-host=_ldap._tcp.gc._msdcs.[MYDOMAIN],dc01.[MYDOMAIN],3268,1
    srv-host=_ldap._tcp.gc._msdcs.[MYDOMAIN],dc02.[MYDOMAIN],3268,2
    srv-host=_ldap._tcp.dc._msdcs.[MYDOMAIN],dc01.[MYDOMAIN],389,1
    srv-host=_ldap._tcp.dc._msdcs.[MYDOMAIN],dc02.[MYDOMAIN],389,2
    srv-host=_ldap._tcp.pdc._msdcs.[MYDOMAIN],dc01.[MYDOMAIN],389
    srv-host=_ldap._tcp.default-first-site-
name._sites.dc._msdcs.[MYDOMAIN],dc01.[MYDOMAIN],389,1
    srv-host=_ldap._tcp.default-first-site-
name._sites.dc._msdcs.[MYDOMAIN],dc02.[MYDOMAIN],389,2
    srv-host=_kerberos._udp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kerberos._udp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kerberos._tcp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kerberos._tcp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kerberos-master._tcp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kerberos-master._tcp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kerberos-master._udp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kerberos-master._udp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kpasswd._tcp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kpasswd._tcp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kpasswd._udp.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kpasswd._udp.[MYDOMAIN],dc02.[MYDOMAIN],88
    srv-host=_kerberos._tcp.dc._msdcs.[MYDOMAIN],dc01.[MYDOMAIN],88
    srv-host=_kerberos._tcp.dc._msdcs.[MYDOMAIN],dc02.[MYDOMAIN],88
    txt-record=_kerberos.[MYDOMAIN],"[MYDOMAIN]"

Outside of these SRV records, I made a few A-record and CNAME records
in the Pi-Hole to help bridge everything over. From the test machine I
can resolve the \[MYDOMAIN\], wpad.\[MYDOMAIN\] to the domain
controller's IP. The A-records go straight to the domain controller's
IP. I used the FQDN when making these A-records.

One thing to note. Pi-Hole complains when you define multiple
A-records for the same host name, but Microsoft is just dandy with it?
What gives? I had to define A-records for \[MYDOMAIN\] to include both
IPs for the domain controllers. (Failover, I guess)

----------------------------------------------------------------------
ElevenNotes · 2023-12-03 11:05

That's not how that works. Your PiHole has to send all queries for
your AD to your AD DNS, you can't remove AD DNS, AD does only work
with DNS. You can simply tell PiHole to send all request for
ad.domain.com to your AD DNS, and then set your PiHole on every client
as DNS server. Any AD request will go to your PiHole and your PiHole
will redirect all queries for the AD to the AD DNS.

----------------------------------------------------------------------
Apart_Ad_5993 · 2023-12-03 16:48

You can't remove AD DNS for PiHole. PiHole can be the upstream DNS
server but it cannot replace ADDns.