| Previous | Next |
| DNS_ERROR_BACKGROUND_LOADING | DNS_ERROR_NOT_ALLOWED_UNDER_DNAME |
DNS_ERROR_NOT_ALLOWED_ON_RODC
The DNS server is running on a read-only domain controller
MS-DNSP defines an RODC as a domain controller that does not accept originating updates. Directory-integrated DNS zones are stored as directory objects, so many management changes ultimately require LDAP writes to dnsZone or dnsNode data. A DNS service on an RODC can answer from replicated data without becoming a writable master for those objects.
Identify whether the operation changes zone configuration, records, directory-partition membership, or another replicated object. Run that change against a writable DNS server or domain controller that hosts the relevant zone. Do not diagnose this as a generic ACL problem: granting the caller more rights does not convert an RODC into a server that accepts originating directory updates.
What to inspect
- Confirm the target computer is an RODC and identify a writable DNS server for the same zone.
- Determine which directory-backed DNS object the operation would modify.
- Perform the change on a writable replica and then verify replication to the RODC.
References
- MS-DNSP glossary: root hints, RODC, and DNS server terms
- Microsoft: Active Directory-integrated DNS zones
- MS-DNSP: dnsRecord storage format for directory-integrated zones
Looking for a different code? Search another status or error code.