dns Archives - IT-Admins

Windows Print Server Aliases – what is that and why would you even need to think about it?

For File-Servers, you can set up DFS structures and have a single point of entry as from the perspective of the client. It’s a simple named path and works rather flawless if set up right and monitored e.g. with PRTG. But what about your print server? Is it a defined hostname and the printers sit on this host? What happens when you want to upgrade the host to a new windows version or theoretically even do some special DNS routing (that’s very advanced and has hurdles, I will not address this in this posting).

Well – you can sure set up an ALIAS name in your DNS, but soon you will discover you can’t connect to the printers on this server. This is because you are missing some registry tweaks. At this point I also want to make you aware, I saw Windows updates removing those keys, so keep this article handy to reconstruct the registry in case of any issues.

You will need a total of three registry keys added, as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\DnsOnWire=dword:00000001

1	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\DnsOnWire=dword:00000001

This first key will enable DNSOnWire for the Print-Server itself. This is needed to make the print-server aware that you might use DNS ALIAS / CNAME entries to access him. More can be found e.g. here: Windows couldn’t connect to the printer – Windows Server | Microsoft Docs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\DisableStrictNameChecking=dword:00000001

1	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\DisableStrictNameChecking=dword:00000001

This key, DisableStrictNameChecking, we need to configure the SMB server / LANManServer – he needs to be aware as well that we will use CNAMES to access the shares on the server. You can find some more information at the following link: Can’t access SMB file server – Windows Server | Microsoft Docs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\OptionalNames=reg_sz:YourCNAMEEntry

1	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\OptionalNames=reg_sz:YourCNAMEEntry

And last but not least, the OptionalNames – this is the one key that’s most hidden but still so important. You can also make it REG_MULTI_SZ key. But it works with a simple REG_SZ key and the short CNAME alias that you have specified, you don’t even need use the FQDN.

There are many ways on how to accomplish this one last key, it changed throughout the Windows versions, it was possibly even renamed. Worst I saw on a Windows 2016 server was it vanished after a update session and reboot. So be prepared for that. A simple recreation and reboot fixed the issues.

Also, make sure you reboot after those changes, otherwise it won’t work.

If you are using multiple web servers and some more advanced DNS configuration like e.g. Round-Robin (and other) to load balance and possibly even GEO divide traffic to those web servers while those are all hosting the same web site you might as well want to monitor if this is all working as expected.

The challenge in this case is – your monitoring system might get just a single IP that might even change every now and then back from DNS when it requests it from DNS. So you would end up needing to use the target IP addresses of the individual web servers instead. But those expect you that your request for the web site goes through the domain name, since the servers aren’t supposed to answer on direct host-name / IP address requests or another web-site might be hosted there.

In order to accomplish this – I wrote the script below. It allows you to request a website directly from an IP address while injecting the DNS host in the header section of the Invoke-WebRequest (IWR) in PowerShell.

If you need to target a specific target site you can inject of just the IP address additional information, for example:

Standard parameters
- -DomainName “google.com” -IP “8.8.8.8”
  - this will request the web-root / default page
Sub-Page parameters
- -DomainName “google.com” -IP “8.8.8.8/monitoring.html”
  - this will request the content of /monitoring.html on the IP 8.8.8.8 with the DNS name google.com

PS: Please be aware – the above will not work – 8.8.8.8 is a Google-DNS server and not one of their web-servers. The above is only an example to show what is possible.

The below script output was optimized to be used in PRTG.

param(
    [string] $DomainName = "",
    [string] $IP = "",
    [string] $KeyWord = " ",
    [int] $MinimumResponseSizeInByte = 1,
    [bool] $useHTTPS = $true
)
add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) { 
    $Prefix = "https://" 
} Else { 
    $Prefix = "http://" 
}

$IWRResponse = "";
$IWRError = 0;
$IWRErrorMessage = "";

$IWRResponse = Try {
    Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop
} Catch {
    $IWRError = $_.Exception.GetHashCode()        
    If ($IWRError -eq 0) {
        $IWRError = 1 
    }
    $IWRErrorMessage = $_.Exception.Message
}
Try {
    $IWRResponse = $IWRResponse.ToString()
} Catch {}

$KeyWordFound = 0
Try {
    If ($IWRResponse.Contains($KeyWord)) { 
        $KeyWordFound = 1 
    } 
} Catch {}

$ResponseSufficient = 0 
Try {
    If ($IWRResponse -gt $MinimumResponseSizeInByte) { 
        $ResponseSufficient = 1 
    }  
} Catch {}

$XML = "<prtg>
    <result>
        <channel>Check result</channel>
        <value>$IWRError</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>0</LimitMinError>
        <LimitMaxError>0</LimitMaxError>
        <LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>
    </result>
    <result>
        <channel>Keyword found</channel>
        <value>$KeyWordFound</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>
    </result>
    <result>
        <channel>Response Length</channel>
        <value>" + $IWRResponse.Length + "</value>
        <VolumeSize>Byte</VolumeSize>
        <NotifyChanged>1</NotifyChanged>
    </result>
    <result>
        <channel>Reponse Length sufficient</channel>
        <value>$ResponseSufficient</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Response size not sufficient</LimitErrorMsg>
    </result>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

100

param(

[string] $DomainName = "",

[string] $IP = "",

[string] $KeyWord = " ",

[int] $MinimumResponseSizeInByte = 1,

[bool] $useHTTPS = $true

)

add-type @"

using System.Net;

using System.Security.Cryptography.X509Certificates;

public class TrustAllCertsPolicy : ICertificatePolicy {

public bool CheckValidationResult(

ServicePoint srvPoint, X509Certificate certificate,

WebRequest request, int certificateProblem) {

return true;

}

[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) {

$Prefix = "https://"

} Else {

$Prefix = "http://"

}

$IWRResponse = "";

$IWRError = 0;

$IWRErrorMessage = "";

$IWRResponse = Try {

Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop

} Catch {

$IWRError = $_.Exception.GetHashCode()

If ($IWRError -eq 0) {

$IWRError = 1

}

$IWRErrorMessage = $_.Exception.Message

}

Try {

$IWRResponse = $IWRResponse.ToString()

} Catch {}

$KeyWordFound = 0

Try {

If ($IWRResponse.Contains($KeyWord)) {

$KeyWordFound = 1

}

} Catch {}

$ResponseSufficient = 0

Try {

If ($IWRResponse -gt $MinimumResponseSizeInByte) {

$ResponseSufficient = 1

}

} Catch {}

$XML = "<prtg>

<channel>Check result</channel>

<value>$IWRError</value>

<LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>

</result>

<channel>Keyword found</channel>

<value>$KeyWordFound</value>

<LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>

</result>

<channel>Response Length</channel>

<value>" + $IWRResponse.Length + "</value>

</result>

<channel>Reponse Length sufficient</channel>

<value>$ResponseSufficient</value>

<LimitErrorMsg>Response size not sufficient</LimitErrorMsg>

</result>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

dns

Windows Print Server Aliases

Request a DNS based web site directly from an IP address

Recent blog posts

Blog Archives

dns

Recent blog posts

Blog Archives

Tags