使用组策略禁用dynamicDNS更新

我正在pipe理一个系统，由于我无法控制的原因，有一个不相交的DNS名称空间。 我不喜欢它，但事实就是如此，我无法改变这一点。 原因是服务器需要与预先存在的DNS基础设施共存。

Windows域被命名为ad.example.com，其名称为AD的NETBIOS。 但是，所有DNS服务器都将其主DNS后缀设置为“example.com”或“sub.example.com”，具体取决于它们在networking中的位置。 根据Technet上的“ 创buildDisjoint命名空间”文章，我已经在域中configuration了msDS-AllowedDNSSuffixes属性。

ad.example.com域的DNS在环境中的两个域控制器上运行，而example.com和sub.example.com的DNS在其他非Microsoft DNS服务器上运行。

在这种环境下，DNS是手动pipe理的，而不是依靠dynamicDNS注册和更新。

• 如何使用nsupdate更新通配符dnslogging
• 如何configuration一个AD DC来响应ldaps上的LDAP绑定：//？
• 绑定服务器问题：当DNS Masterclosures时，无法从客户端查找，但仍可以连接到Internet
• 如何禁用OSX上的IPv4使用（或禁用快乐眼球）
• 如何以最less的configurationpipe理我的所有域名？

环境工作正常，除了在事件日志中出现的一些烦人的警告错误，看起来像这样：

The system failed to register host (A or AAAA) resource records (RRs) for network adapter with settings: Adapter Name : <censored> Host Name : <censored> Primary Domain Suffix : sub.example.com DNS server list : <censored> (These are the domain controllers for ad.example.com) Sent update to server : <?> IP Address(es) : <censored> (This is the IP address of the host in question) The reason the system could not register these RRs was because of a security related problem. The cause of this could be (a) your computer does not have permissions to register and update the specific DNS domain name set for this adapter, or (b) there might have been a problem negotiating valid credentials with the DNS server during the processing of the update request. You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information. 

错误出现在系统日志中，源为“DNS客户端事件”，处于警告级别，事件ID为8015。

做一个数据包嗅探，似乎Windows窗口似乎做dynamicDNS更新到权威的sub.example.com，不支持dynamic更新（也不是我们要启用它们）的DNS服务器。

因此，我们设置了使用组策略禁用dynamicDNS更新的任务。

周五，我创build了一个组策略，并将其链接到域的顶部，如下面的截图所示：

策略计算机configuration/策略/pipe理模板/networking/ DNS客户端/dynamic更新已被设置为禁用。

但是，即使在几天（组策略复制并应用到服务器的时间充足）之后，这些事件仍会在日志中出现。

我已经使用GPRESULTvalidation了该策略确实已应用于所讨论的服务器上。

gpresult /scope Computer /v的输出如下（为了匿名目的，删除了一些不相关的数据）：

 Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0 © 2013 Microsoft Corporation. All rights reserved. Created on 2015-10-05 at 15:06:54 RSOP data for AD\ad79632 on BESTLA : Logging Mode -------------------------------------------------- OS Configuration: Member Server OS Version: 6.3.9600 Site Name: Example Roaming Profile: N/A Local Profile: C:\Users\ad79632 Connected over a slow link?: No COMPUTER SETTINGS ------------------ CN=BESTLA,OU=Servers,OU=Computers,OU=SHEM,DC=ad,DC=example,DC=com Last time Group Policy was applied: 2015-10-05 at 14:09:58 Group Policy was applied from: dc02.example.com Group Policy slow link threshold: 500 kbps Domain Name: AD Domain Type: Windows 2008 or later Applied Group Policy Objects ----------------------------- <some GPOs omitted for security reasons> Disable Dynamic DNS Updates The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The computer is a part of the following security groups ------------------------------------------------------- BUILTIN\Administrators Everyone BUILTIN\Users RDS Endpoint Servers RDS Management Servers RDS Remote Access Servers NT AUTHORITY\NETWORK NT AUTHORITY\Authenticated Users This Organization BESTLA$ Day-active Computers Domain Computers Authentication authority asserted identity System Mandatory Level Resultant Set Of Policies for Computer --------------------------------------- Software Installations ---------------------- N/A Startup Scripts --------------- N/A Shutdown Scripts ---------------- N/A Account Policies ---------------- <some GPOs omitted for security reasons> Audit Policy ------------ N/A User Rights ----------- N/A Security Options ---------------- <some GPOs omitted for security reasons> Event Log Settings ------------------ N/A Restricted Groups ----------------- N/A System Services --------------- N/A Registry Settings ----------------- N/A File System Settings -------------------- N/A Public Key Policies ------------------- N/A Administrative Templates ------------------------ <some GPOs omitted for security reasons> GPO: Disable Dynamic DNS Updates Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\RegistrationEnabled Value: 0, 0, 0, 0 State: Enabled <some GPOs omitted for security reasons> 

问题中的registry键实际上已经更新，如下图所示：

那么，我错过了什么？