Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, September 4, 2013 3:23 PM
I want to know if there is a way to alias a FQDN domain name. It would be similar to using NETBIOS name. Specifically I want to take for example our domain companyname.com and alias it as to something simple like "Bob".
The goal would be able to do something like \companyname.com\dfsshare to something more like \bob\dfsshare
Is something like this possible?
All replies (1)
Thursday, September 5, 2013 4:34 AM âś…Answered
That may not be possible, since the FQDN also aligns with the SPN. The folks I've known to try it resulted in no luck, even trying to register the SPN. You can try it, and report back with your results.
Here are my notes on it - I hope it helps to understand what you have to go through to possibly make it work.
-
Creating Netbios name CNAME Alias in DNS:
> I tried adding a cname alias but when I try to connect it says that
> duplicate server name existing (old server is disconnected). But I
> can ping by the cname and it redirects ok just not able to access
> share.
Add the registry entry noted in this KB to the server you are trying to alias.
281308 - Connecting to SMB share on a Windows 2000-based computer or a
Windows Server 2003-based computer may not work with an alias name:
http://support.microsoft.com/?id=281308
Error message when you use user credentials to connect to a network share from a Windows-based computer: "The network folder specified is currently mapped
using a different user name and password" (This shows how to create a DNS alias to the resource):
http://support.microsoft.com/kb/938120
-
==================================================================
How to Configure Windows Machine to Allow File Sharing with DNS Alias
Posted by Michael
June 10, 2009
microsoft.public.windows.server.networking newsgroup
I haven't seen one article that brings together all the settings one
would need to do to make this work properly on Windows, so I thought I
would post it here.
To facilitate failover schemes, a common technique is to use DNS CNAME
records (DNS Aliases) for different machine roles. Then instead of
changing the Windows computername of the actual machine name, one can
switch a DNS record to point to a new host.
This can work on Microsoft Windows machines, but to make it work with
file sharing the following configuration steps need to be taken.
== Outline ==
1. The Problem
2. The Solution
* Allowing other machines to use filesharing via the DNS
Alias (DisableStrictNameChecking)
* Allowing server machine to use filesharing with itself via
the DNS Alias (BackConnectionHostNames)
* Providing browse capabilities for multiple NetBIOS names
(OptionalNames)
* Register the Kerberos service principal names (SPNs) for
other Windows functions like Printing (setspn)
3. References
== The Problem ==
On Windows machines, file sharing can work via the computer name, with
or without full qualification, or by the IP Address. By default,
however, filesharing will not work with arbitrary DNS aliases. To
enable filesharing and other Windows services to work with DNS
aliases, you must make registry changes as detailed below and reboot
the machine.
== The Solution ==
=== Allowing other machines to use filesharing via the DNS Alias
(DisableStrictNameChecking) ===
This change alone will allow other machines on the network to connect
to the machine using any arbitrary hostname. (However this change will
not allow a machine to connect to itself via a hostname, see
BackConnectionHostNames below).
* Edit the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Services\lanmanserver\parameters and add a value
DisableStrictNameChecking of type DWORD set to 1.
=== Allowing server machine to use filesharing with itself via the DNS
Alias (BackConnectionHostNames) ===
This change is necessary for a DNS alias to work with filesharing from
a machine to find itself. This creates the Local Security Authority
host names that can be referenced in an NTLM authentication request.
To do this, follow these steps for all the nodes on the client
computer:
1. To the registry subkey HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\Lsa\MSV1_0, add new Multi-String Value
BackConnectionHostNames
2. In the Value data box, type the CNAME or the DNS alias, that is
used for the local shares on the computer, and then click OK.
* Note: Type each host name on a separate line.
=== Providing browse capabilities for multiple NetBIOS names
(OptionalNames) ===
Allows ability to see the network alias in the network browse list.
1. Edit the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
\Services\lanmanserver\parameters and add a value OptionalNames of
type Multi-String
2. Add in a newline delimited list of names that should be
registered under the NetBIOS browse entries
* Names should match NetBIOS conventions (i.e. not FQDN,
just hostname)
=== Register the Kerberos service principal names (SPNs) for other
Windows functions like Printing (setspn) ===
NOTE: Should not need to do this for basic functions to work,
documented here for completeness. We had one situation in which the
DNS alias was not working because there was an old SPN record
interfering, so if other steps aren't working check if there are any
stray SPN records.
You must register the Kerberos service principal names (SPNs), the
host name, and the fully-qualified domain name (FQDN) for all the new
DNS alias (CNAME) records. If you do not do this, a Kerberos ticket
request for a DNS alias (CNAME) record may fail and return the error
code KDC_ERR_S_SPRINCIPAL_UNKNOWN.
To view the Kerberos SPNs for the new DNS alias records, use the
Setspn command-line tool (setspn.exe). The Setspn tool is included in
Windows Server 2003 Support Tools. You can install Windows Server 2003
Support Tools from the Support\Tools folder of the Windows Server 2003
startup disk.
How to use the tool to list all records for a computername:
setspn -L computername
To register the SPN for the DNS alias (CNAME) records, use the Setspn
tool with the following syntax:
setspn -A host/your_ALIAS_name computername
setspn -A host/your_ALIAS_name.company.com computername
=== References ===
All the Microsoft references work via:
1. Connecting to SMB share on a Windows 2000-based computer or a
Windows Server 2003-based computer may not work with an alias name
* Covers the basics of making file sharing work properly
with DNS alias records from other computers to the server computer.
* http://support.microsoft.com/kb/281308
2. Error message when you try to access a server locally by using
its FQDN or its CNAME alias after you install Windows Server 2003
Service Pack 1: "Access denied" or "No network provider accepted the
given network path"
* Covers how to make the DNS alias work with file sharing
from the file server itself.
* http://support.microsoft.com/kb/926642
3. How to consolidate print servers by using DNS alias (CNAME)
records in Windows Server 2003 and in Windows 2000 Server
* Covers more complex scenarios in which records in Active
Directory may need to be updated for certain services to work properly
and for browsing for such services to work properly, how to register
the Kerberos service principal names (SPNs).
* http://support.microsoft.com/kb/870911
4. Distributed File System update to support consolidation roots in
Windows Server 2003
* Covers even more complex scenarios with DFS (discusses
OptionalNames).
* http://support.microsoft.com/kb/829885
==================================================================
Some errors associated with the info above:
Multiple Credentials in a Single Windows NT Session
http://support.microsoft.com/kb/173199/
Error message when you use user credentials to connect to a network share from a Windows-based computer: "The network folder specified is currently mapped using a different user name and password" (This shows how to create a DNS alias to the resource): http://support.microsoft.com/kb/938120
==================================================================
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.