Skip to main content
Flexible Top Header
Question

Primary Domain Suffix - priority via GPO vs DHCP deployment option?

  • August 4, 2026
  • 2 replies
  • 25 views
S

Will be checking this in the lab later this week but looking for opinions. Pertinent to my other post related to cert renewal issues..  

Exploring a work around where we would define laptop’s primary connection suffix via GPO. There are non-MS clients on the same networks so we have to continue to hand out the DNS / DDNS domain deployment options.

I’m wondering assuming we’re already configured in BC with those options and then do the same in GPO, which one wins / is persistent?

Thanks!

    2 replies

    T
    Forum|alt.badge.img+3
    • tmaestas
    • Trusted Resolver
    • August 4, 2026

    The domain that comes via DHCP becomes the Connection Specific DNS Suffix, so this should not compete against a Primary DNS Suffix being assigned by GPO.

    S
    • struttob
    • Author
    • Consistent Uptimer
    • August 5, 2026

    The domain that comes via DHCP becomes the Connection Specific DNS Suffix, so this should not compete against a Primary DNS Suffix being assigned by GPO.

    Thanks, Tim.  What I’m seeing so far in the lab is that if the client isn’t registering itself, instead relaying on DHCPD to use bcnupdate then what’s configured as primary suffix on the client via whatever mechanism (DO or AD GPO) doesn’t seem to come into play.  It seems to only utilize the DO configured for DDNS domain which causes the visiting device to be registered into the hosting site’s DNS zone which leads to cert renewal failure.. Ugly.

    I’ve opened a ticket with my ES team to determine any possible workaround to only conditionally deploy the DDNS zone DO to non-MS clients or key on hostname or something using class match, etc..

    Terms & ConditionsAccessibility statement