I'm facing considerable difficulties with getting dynamic DNS updates to function correctly between non-domain DHCP and DNS servers running Server 2025 and our standard domain servers. Although all necessary ports are open and both server types are on the same VLAN, I'm still encountering major issues. For instance, I keep getting an error 1355 when I try adding credentials via PowerShell for the command set-dhcpserverdnscredentials. Additionally, whenever I attempt to enter credentials through the DHCP GUI, I receive an 'invalid username or password' message after about 30 seconds. I've tried using psexec along with cmdkey commands and have made registry changes for DnsWinUser, but I'm still at a loss. The goal is to facilitate dynamic DNS updates for domain machines on the non-domain DHCP server, especially since it's handling wireless connections via different NICs. This would help update the internal AD/DNS records as devices change IPs. Please note that both secure and nonsecure updates are allowed on AD, and the service account in use has the necessary permissions on the forward and reverse zones. Also, the service account is part of the dnsupdateproxy group. I'm seeking any pointers on what I might be missing here. AI tools have been stumped by my inquiries up to this point. Thanks in advance for any guidance!
2 Answers
Just to clarify, are both your DNS and DHCP services running on non-domain servers? If that’s the case and they are on the same machine, why not consider setting up a new domain specifically for this purpose? Microsoft's RFC on DDNS and DHCP has been around since the year 2000 and might provide useful guidelines for your situation.
It sounds like your setup is facing some limitations because the DHCP server isn't domain-joined. Without that, it's tricky for Kerberos to function correctly, which could lead to the issues with logging in using those credentials. You might find that the safest and most effective route is to actually join the DHCP server to the domain, which can restore proper dynamic DNS update capabilities. This way, you can even re-enable secure dynamic updates. Sure, there might be other complex ways to approach this problem with third-party tools, but they won't be reliable compared to just joining the domain.
Thanks for clarifying! What do you suggest for securing port 67 when allowing only specific subnets?
Yes, the non-domain servers that serve the wireless network indeed have both DHCP and DNS services installed. I'm hesitant about creating a new domain because I want to avoid impacting the system's resilience in case of domain outages.