If your DNS admin has changed the ACLs on the zone, you may well find that an admin user can make records but computer accounts can't, or computers in a certain group can or any number of possible approaches. Under normal operation when a computer updates it's record it is authentication as its own hostname$ AD computer account, this is as a result of the zone having a ACL on it allowing authenticated users to create child items (not having delete permission should be preventing anyone overwriting or deleting anything that they didn't create). creating a new record will likely work for any authenticated user, but it will need to be that suer or an admin who updates that record afterwards.
#MAC ADS CLEANER K UPDATE#
In my testing this only worked to update an existing record when this was an administrative user, specifically one with the permission allowing it to make a DNS update, my standard user account didn't have this permission and as expected the update failed.
I presume when you do this you are using whatever principal you have authenticated into your credential cache when you run the command. One thing that its likely worth checking in a scenation you have described is the ACLs on the AD DNS zone/s.ĪD DNS defaults (IIRC) to only allowing authenticated updates, which should be fine for an AD bound Mac, and it sounds like authenticated DNS updates are working when you use the -g flag on nsupdate. Although this is not quite as dramatically terrible as your issue where things are not working at all. My current issue is that I have some Macs which are sometimes seemingly stopping updating their A records, which leads to scavenging deleting them, which is very annoying. You can, and likely should use something like dsconfigad -restrictDDNS to specific which interface/s you wish to register their IPs against the machines hostname, but under "normal" circumstances it should just work.
#MAC ADS CLEANER K WINDOWS#
Macs with windows DNS should start registering dynamic DNS updates once they are bound. It's been a good few years since your post, but as I'm looking at a similar-ish issue and had a partial answer to your question I thought it might be worth sharing the fruits of my evening re-acquainting myself with DNS OSX and Kerberos.
0 kommentar(er)
