Blog Post

Core Infrastructure and Security Blog

3 MIN READ

Using Computer Name Aliases in place of DNS CNAME Records

Microsoft

Sep 20, 2018

First published on TechNet on Jun 19, 2017
Hi everyone. Graeme Bray here with an article around using Computer Name Aliases instead of DNS CName records. In the past, we used to set the registry key DisableStrictNameChecking to be able to add a DNS alias to connect via a name (such as fileserver.contoso.com). Starting with Windows Server 2008, we added functionality to be able to create a computer alias. What benefits does using computer aliases provide?

Automatic SPN management for Kerberos authentication.
No DNS access required
Automatic DNS entry updates for DNS A Records.
Eliminate the need and risk of editing the registry for "DisableStrictNameChecking" and "OptionalNames" keys

What benefits does using a DNS CName provide?

Aliases pointing to a computer name, not an IP address

To create a computer name alias, it's a very simple process. You need to run as an elevated Powershell (or command prompt) window. Enter the command as below, and you're done.

Command: Netdom computername <COMPUTER> /add:<ALIAS>

Example: Netdom computername IIS01 /add:webapp.surface.graemebray.com

This adds the DNS entry appropriately. To confirm, do one of the two following steps:

1a. Open DNS and look for your entry (sort by name or IP address)

1b. Query for the machine and entries you submitted via PowerShell.

This will allow you to securely access SMB shares. It'll register the DNS A record, register additional SPNs, and add OptionalNames registry key. It'll save you from modifying SPNs manually and no CNAME mess.

Verify ComputerName Aliases

The most important part to confirm is after we have finished all of this work. We know the DNS entry exists, but how can we confirm the computer object contains all of the appropriate aliases? If we stick with my IIS01 machine, we can run: netdom computername iis01 /enum

This will output a list of all computer names associated with this object.

Verify Service Principal Names

The most important reason to do all of this work is to have all of the Kerberos magic done for you. This can also be verified once the above sets of steps are completed. If you run setspn -l <computer> you can see the list of all SPN records created.

Remove Computer Alias

The ability to remove the alias is just as easy. Swap "add" for "remove", and you're good to go. Netdom computername <COMPUTER> /remove:<ALIAS>

Troubleshooting:

Below are some troubleshooting tips if you run into errors when trying to create a computername alias.

Problem #1: "The specified domain either does not exist or could not be contacted."

Solution: Make sure you have connection to the domain controller. In my example, I didn't have an IP address.

Problem #2: "Access is denied"

Solution: The user ID must have Write permissions to msDS-AdditionalDnsHostName on the object within Active Directory. You can see the modification attempt via the packet capture data below.

Problem #3: "The system cannot open the device or file specified."

Solution: This computer name alias already belongs to another machine. Be careful with this issue, at time of this writing, on Server 2012 R2, the computer name alias will show up on the second machine you run it on.

Additional Reading:

Here are the pertinent Technet links/articles, as always:

Netdom Computername: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc835082(v=ws.11)

SetSPN: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11)

Updated Nov 09, 2023

Version 7.0

GraemeBray

BrandonWilson

Microsoft

Joined April 24, 2018

View Profile

Core Infrastructure and Security Blog

Follow this blog board to get notified when there's new activity

11 Comments

FMCUjonesc
Copper Contributor
Oct 25, 2024
Does all of this also apply to failover cluster role computer accounts? Anything to be aware of if appending an SPN in this scenario?
David_Trevor
Copper Contributor
Nov 12, 2023
Careful: This registry key (DWORD) is still needed when you want to access network shares over SMBv1. Setting the registry key requires a reboot
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
DisableStrictNameChecking = 1
Joshua_Park1900
Copper Contributor
Sep 12, 2023
grommit I found a solution to this problem today. Seems as though the print spooler service by default only uses the local machine name and that's by design by Microsoft. I found an MS article with a workaround that resolved the error for me and I've been able to add printers using the secondary name I assigned using the steps documented here by BrandonWilson . A regedit needs to be applied so the print server will also use DNS names. No restart required, but I did stop and start the spooler service after adding this registry setting.

Command:
reg add HKLM\SYSTEM\CurrentControlSet\Control\Print /v DnsOnWire /t REG_DWORD /d 1

From https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/windows-couldnt-connect-printer
grommit
Brass Contributor
Sep 12, 2023
Joshua_Park1900 Just checked, I never found a solutions so ended up just using the server name as couldn't justify spending more chargeable time on this.
Joshua_Park1900
Copper Contributor
Sep 11, 2023
grommit did you ever find a solution to your problem? I'm sharing the same issue after following the steps in the OP article.
grommit
Brass Contributor
Apr 19, 2023
This isn't working for me.
I ran 'Netdom computername FP01 /add:printers.domain.lan'.
After running ipconfig /registerdns an A-record for printers.domain.lan appeared in Windows DNS server forward lookup zone.

Checked HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters and the OptionalNames entry exists containing printers.

But GPO fails to map the printer due to "Group Policy Object did not apply because it failed with error code '0x80070709 The printer name is invalid".

From client PC I can browse to printers.domain.lan and can see the shared printer, but if try to open it then I get "Operation could not be completed (error 0x00000709) Double check the printer name and make sure that the print is connected to the network".
If I right click the printer and select connect I get "Windows couldn't connect to the printer. CHeck the printer name and try again. If this is a network printer, make sure that the printer is turned on and that the printer address is correct".

If I use the computer name fp01.domain.lan in GPO then it works.
If I browse to \\fp01.domain.lan then I can open and or connect the printer no problem.
Andrew_Allston
Iron Contributor
Sep 13, 2022
nefarOG Might help to read the command correctly, its netdom not netmon... Also depending on your version of windows and Powershell you might need to do it in a cmd window...

But who am I to say?
illy_velo
Copper Contributor
Jun 02, 2022
nefarOG

netmon is not related to this article, the command is netdom.
LainRobertson
Silver Contributor
Apr 16, 2022
Kapil_Madaan

What you're trying to do doesn't relate to this article. Load balancing is an entirely separate discussion - sharing Kerberos alone as a topic isn't a strong enough bond to make these discussions one and the same.

Speaking to your issue.

By default, the "server" service runs under the "local system" security principal, which in turn is represented by the computer object in Active Directory. If you have two file servers then you're talking about needing to add an identical servicePrincipalName to both computer objects, which as both you and the article have pointed out, you cannot do. If your "farm" had ten servers then you'd have ten computer objects to deal with, and so on.

What you have to do is solve the per computer identity requirement outlined above, and the high level workflow for doing that is:

Create a service account in Active Directory;
Configure the "Server" service on each "farm" member to run under this identity;
Add all the relevant servicePrincipalName values to this service account.

What this achieves is effectively running the same servicePrincipalName configuration across all "farm" members, which will resolve your brief observation above where one access attempt succeeds while the next fails.

Also, make sure you have set the "Session persistence" to "Client IP" or else you're going to run into additional issues as SMB isn't like stateless HTTP.

Configure Azure Load Balancer distribution mode - Azure Load Balancer | Microsoft Docs
Kapil_Madaan
Copper Contributor
Apr 14, 2022
Hi Brandon,

What If we have 2 servers (PrintServer1 and PrintServer2) behind Azure loadbalancer (PrinterServerLB) with CNAME "MyPrint" pointing to HostA record "PrinterServerLB"

This is how DNS looks.

PrintServer1 Host A 10.10.10.11
PrintServer2 Host A 10.10.10.11
PrinterServerLB Host A 10.10.10.10
MyPrint CNAME PrinterServerLB.Domain.Local

\\MyPrint works
\\MyPrint fails with authentication popup

I cant add SPN "MyPrint" on 2 Print Servers.

Kapil