u/charanreddy234

Hi everyone,

We have a new requirement to enable DNSSEC on our AD-integrated DNS which we never had or worked before. We already tried pushing back, explaining that it’s not really recommended for an internal environment that isn't internet facing, and that the operational overhead completely outweighs the minimal security benefits.

But management insisted, so here we are preparing the deployment. We have 4 dcs total.

I’d love to get some real-world suggestions and feedback from anyone who has done this:

Have you seen any weird side effects or negative impacts on the environment after turning it on?

What specific areas should we audit or assess before we flip the switch?

Do any common applications tend to break or get impacted by this?

We know the zone file size and packet sizes will increase, but is there a reliable way to benchmark/evaluate that overhead beforehand?

Our environment actually has more Linux machines than Windows. Any specifics we should look out for with Linux clients?

Is it possible to completely skip signing the _msdcs folder where the AD service locators live, or does the whole zone have to be signed together?

Any best and safest plan to deploy it.

These are a lot of questions, but please bear with me as this is all very new to me. My main concern is that since this is AD-integrated DNS, it is the critical foundation that clients hit first for all AD authentication and services 🙂

Hi ,

We have a requirement to enable DNS analytical logs on our domain controllers. However, I am concerned that this will generate a massive volume of logs. The requirement is to maintain a log retention period of at least 30 days. Because Event Viewer manages retention by maximum log size rather than days, I conducted an assessment.

I ran a "DNS queries per second" command for one hour. Based on those results, I calculated that it will generate roughly 6.5 GB per hour. Adding a 2.5 GB buffer, I estimated a total of 9 GB to 10 GB per hour overall. So for 30 days it requires tb's of size.However, I am not completely sure if my math is correct or if this is the right way to approach the assessment.

Could someone help me with the following questions?

Is my current approach correct? How exactly can I estimate the log size required to meet the 30-day retention requirement? I know there is no 100% guaranteed formula, but I need at least a reliable, rough estimate. Or is this not at all the correct way.

What is the exact impact on Domain Controller performance and CPU utilization

What is the worst-case scenario or major challenges we might face on the domain controllers by enabling this?

What are the best solutions or alternatives for this? I know a SIEM solution is ideal, but due to certain constraints, we must store these logs locally on the servers for 30 days

As I understand it, Microsoft makes MFA mandatory for admin portals regardless of what we configure at the tenant level. However, I need some suggestions: Is there any way an organisation can bypass MFA for emergency accounts? Alternatively, if an organisation does not use phishing-resistant MFA like passkeys or certificates, how do they handle this situation safely?

Hi everyone,

We are planning to migrate from Entra Connect Sync to Cloud Sync. We haven’t found many dependencies on Entra Connect so far, except for device sync.

Currently, we are syncing an OU that has computer objects (Windows and Linux). If we select the same OU in Cloud Sync, will there be any issues? As per the documentation it says it's under preview not sure whether we can consider or not.

Can we expect it to work the same way as Entra Connect, or are there any differences/limitations with syncing computer objects in Cloud Sync?

This is our main concern before moving ahead. Can anyone help me here whether we Can migrate to cloud sync or not? If any recommendations or testing we can kindly help.