Purpose of Windows 2000 DC DNS SRV Records

In Microsoft Windows 2000 Server, the introduction of Active Directory fundamentally changed how network resources and servers were identified, shifting dependency from NetBIOS and WINS to standard Domain Name System (DNS) protocols. DNS Service Location (SRV) records, defined in RFC 2052, serve as the backbone of this architecture by enabling client computers to dynamically locate domain controllers and specific services like Kerberos and LDAP across the network. This article explains the technical purpose, structure, and critical functions of the DNS SRV records registered by Windows 2000 domain controllers.

The Role of SRV Records in Active Directory

Prior to Windows 2000, Windows NT relied heavily on NetBIOS broadcasts and WINS to locate primary and backup domain controllers. Windows 2000 replaced this mechanism with the Active Directory Locator service (DC Locator), which utilizes DNS SRV records.

An SRV record maps the name of a specific service, protocol, and domain to the fully qualified domain name (FQDN) and TCP/UDP port number of the host server offering that service. Instead of requiring clients to know the exact IP address or name of a domain controller in advance, clients simply query DNS for the required service.

Core Services Registered by Windows 2000 Domain Controllers

When a Windows 2000 server is promoted to a domain controller, the Netlogon service automatically registers several standard SRV records within DNS via Dynamic Update (RFC 2136). These records point to several critical functions:

  • LDAP (_ldap._tcp): Lightweight Directory Access Protocol records allow clients to find domain controllers providing Active Directory access. This is essential for user logons, directory queries, and Group Policy application.
  • Kerberos (_kerberos._tcp and _kerberos._udp): Kerberos replaced NTLM as the default authentication protocol in Windows 2000. These records direct clients to Key Distribution Centers (KDCs) to request authentication tickets.
  • Global Catalog (_gc._tcp): Active Directory uses the Global Catalog to store a partial replica of all objects in the forest. These records enable clients to find Global Catalog servers for forest-wide searches and universal group membership evaluation during logon.
  • Kpasswd (_kpasswd._tcp): This record points clients to the Kerberos password-change service, enabling secure password changes across the network.

Site-Specific Optimization

Windows 2000 introduced the concept of Active Directory Sites to represent physical network topology. To reduce costly wide-area network (WAN) traffic, the Netlogon service registers both generic domain-wide SRV records and site-specific SRV records.

Site-specific records follow the format _Service._Protocol.SiteName._sites.dc._msdcs.DomainName. When a client boots or logs on, it queries DNS for a domain controller within its assigned site first. If a local domain controller is available, the client connects to it directly, ensuring fast logon performance and minimal bandwidth usage. If no local domain controller responds, the client falls back to the generic SRV records to find any operational domain controller in the domain.

Fault Tolerance and Load Balancing

DNS SRV records include parameters for priority and weight, which Windows 2000 uses to optimize client traffic:

  • Priority: Lower priority values are tried first. If multiple servers have the same priority, the client distributes requests based on weight.
  • Weight: Used to balance load among multiple domain controllers of identical priority. Controllers with higher processing capacity can be assigned higher weight values to handle more requests.
  • Port: Explicitly directs the client to the correct listening port (for example, port 389 for standard LDAP or port 88 for Kerberos), standardizing communication across the infrastructure.

Management via the Netlogon Service

The Netlogon service is solely responsible for creating and maintaining these records. On every Windows 2000 domain controller, Netlogon generates a local text file located at %SystemRoot%\System32\Config\Netlogon.dns.

This file contains the exact list of all SRV and host (A) records the domain controller must register in DNS. If the DNS server does not support dynamic updates, an administrator can use the contents of Netlogon.dns to populate the records manually. Without these SRV records operating correctly in DNS, domain-joined Windows 2000 clients cannot find domain controllers, leading to authentication failures and an inability to process directory services.