AD DS Auth for Azure File Shares / DNS Configuration Question

%3CLINGO-SUB%20id%3D%22lingo-sub-1488873%22%20slang%3D%22en-US%22%3EAD%20DS%20Auth%20for%20Azure%20File%20Shares%20%2F%20DNS%20Configuration%20Question%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488873%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%20I'm%20setting%20up%20our%20environment%20to%20%22enable%20AD%20DS%20authentication%20for%20your%20Azure%20file%20shares%22%20which%20was%20just%20recently%20offered%20in%20Azure.%20There%20are%20couple%20things%20that%20you%20have%20to%20do%20to%20get%20this%20work%20and%20one%20of%20them%20is%20to%20'Configure%20DNS%20forwarding%20for%20Azure%20Files%22.%20The%20link%20to%20do%20this%20is%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fstorage%2Ffiles%2Fstorage-files-networking-dns%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fstorage%2Ffiles%2Fstorage-files-networking-dns%3C%2FA%3E%3C%2FP%3E%3CP%3EAs%20part%20of%20the%20setup%20you%20have%20to%20use%20some%20commands%20in%20the%20Azure%20File%20Hybrid%20PowerShell%20module.%20One%20of%20these%20commands%20is%20%22New-AzDnsForwarder%22.%20Based%20on%20the%20doc%2C%20it%20seems%20that%20this%20command%20will%20(1)%20create%202%20DNS%20servers%20in%20your%20Azure%20subscription%20and%20then%20(2)%20will%20create%20a%20Conditional%20Forwarder%20on%20your%20on-premises%20DNS%20servers%20for%20the%20core.windows.net%20domain.%3C%2FP%3E%3CP%3EI%20understand%20what%20needs%20to%20be%20done%20to%20configure%20DNS%20for%20AD%20DS%20authentication%20to%20work%2C%20however%2C%20I%20question%20what%20the%20New-AzDnsForwarder%20command%20does%20to%20your%20on-prem%20DNS%20servers.%20Questions%20like%3A%20(1)%20How%20does%20the%20command%20figure%20out%20which%20DNS%20servers%20that%20are%20in%20my%20on-prem%20environment%20(DNS%20servers%20exist%20on%20all%20of%20the%20internal%20domain%20controllers%20and%20there%20are%20many).%20(2)%20How%20does%20the%20command%20select%20which%20DNS%20server%20to%20add%20the%20Conditional%20Forwarder%20configuration%20to%3F%20(3)%20Does%20it%20configure%20the%20Conditional%20Forwarder%20on%20one%20DNS%20server%20or%20all%20of%20them%3F%3C%2FP%3E%3CP%3EI'm%20skeptical%20to%20run%20this%20command%20until%20I%20know%20a%20little%20bit%20more%20of%20what%20it%20does%20to%20my%20on-prem%20environment.%3C%2FP%3E%3CP%3EDoes%20anybody%20have%20any%20detailed%20information%20on%20what%20the%20New-AzDnsForwarder%20command%20actually%20does%20to%20your%20Active%20Directory%20architecture%3F%3C%2FP%3E%3CP%3EAny%20feedback%20would%20be%20much%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi all, I'm setting up our environment to "enable AD DS authentication for your Azure file shares" which was just recently offered in Azure. There are couple things that you have to do to get this work and one of them is to 'Configure DNS forwarding for Azure Files". The link to do this is: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-networking-dns

As part of the setup you have to use some commands in the Azure File Hybrid PowerShell module. One of these commands is "New-AzDnsForwarder". Based on the doc, it seems that this command will (1) create 2 DNS servers in your Azure subscription and then (2) will create a Conditional Forwarder on your on-premises DNS servers for the core.windows.net domain.

I understand what needs to be done to configure DNS for AD DS authentication to work, however, I question what the New-AzDnsForwarder command does to your on-prem DNS servers. Questions like: (1) How does the command figure out which DNS servers that are in my on-prem environment (DNS servers exist on all of the internal domain controllers and there are many). (2) How does the command select which DNS server to add the Conditional Forwarder configuration to? (3) Does it configure the Conditional Forwarder on one DNS server or all of them?

I'm skeptical to run this command until I know a little bit more of what it does to my on-prem environment.

Does anybody have any detailed information on what the New-AzDnsForwarder command actually does to your Active Directory architecture?

Any feedback would be much appreciated.

5 Replies

@J_Bush 

 

I am actually wondering this aswell, have you ever managed to find out what this exactly does? Can't find any in-depth manual about what all those things actually do..

@J_Bush 

 

Hi 

 

It will apply forwarders on all on premise DNS servers if you don't specify the  OnPremDnsHostNames

parameter. 

OnPremDnsHostNamesHashSet<string>A manually specified list of on-premises DNS host names to create forwarders on. This parameter is useful when you do not want to apply forwarders on all on-premises DNS servers, such as when you have a range of clients with manually specified DNS names.

@DP 

Hi  

It will apply forwarders on all on premise DNS servers if you don't specify the  OnPremDnsHostNames

parameter. 

OnPremDnsHostNamesHashSet<string>A manually specified list of on-premises DNS host names to create forwarders on. This parameter is useful when you do not want to apply forwarders on all on-premises DNS servers, such as when you have a range of clients with manually specified DNS names.

@ibrahimambodji 

 

So if I am correct you run the "New-AzDnsForwarder" from within your Azure DNS server, where you specify your "OnPremDnsHostNames". Am I saying that correct?

 

The only point I am sceptical about is does the "NewAzDnsForwarder" command also spawn new Azure DNS servers or am I seeing that wrong?

 

Thanks for your answer.

@DP 

Hi

You can run it everywhere  with the right powershell module and the right credentials for your subscription . Yes you're right it's also  mentionned in the documentation : 

 

By default, New-AzDnsForwarder deploys two DNS servers in your Azure virtual network, in an Availability Set, to ensure redundancy. This number may be modified as desired.

By default, the DNS servers will be deployed into the same resource group as the virtual network.

 

The doc i'm referring to 

Configuring DNS forwarding for Azure Files | Microsoft Docs