SCOM 2007 R2 and Windows 2008 R2 DNS Issues
Posted in SCOM, Work on September 10th, 2010 by Tom – Be the first to commentIssue 1 – DNS 2008 External Resolution always in “critical” state
This is an issue with how the monitor performs the test. This link has a great explanation. I followed the instructions at the bottom and overrode the monitor to change the query from type NS to type A and everyone started working. Of course before doing this I spent half a day testing DNS on each server manually and trying to figure out what was going on.
Issue 2 – TrustAnchors
Another error the pops up is DNS 2008 Zone Resolution Monitor – TrustAnchors. This is constantly on alert status. This error is related in new functionality in Windows Server 2008 R2 for support of DNSSEC. This link has a great summary of the issue. Similar to this link, I just disabled this particular monitor as I am not using DNSSEC. You can disable it in Monitoring -> Microsoft Windows DNS Server -> Domain Health State View -> open the TrustAnchors Domain -> Go to Properties of the monitor and override it to set to Enabled = False.
Issue 3 – Cisco firewall throwing away some DNS packets
I didn’t actually run into this problem due to my configuration, but I easily could have. I found the issue as I was trying to investigate Issue 1 above. The issue is some external lookups can fail when DNS packets come in with a size larger then 512 bytes. This occurs from EDNS and DNSSEC. See this post for a better idea as well as the solution when using Cisco PIX/ASA firewalls.