# Pihole as Primary DNS with Active Directory

**URL:** <https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800>\
**Category:** Help\
**Created:** [October 26, 2022, 2:51am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800 "2022-10-26T02:51:37Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [October 26, 2022, 2:51am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/1 "2022-10-26T02:51:37Z")

</div>

Hi,

Im trying to setup my Pihole to be the primary DNS for Windows clients trying to connect to Active Directory. So far, my search has been less than encouraging to say the least.

What I want to do is have the clients use the PiHole to look for the active Directory. If it doesn't find it, it will forward the request by using "conditional forwarding" to active directory. Active Directory will reply and allow new Windows client to join the Windows Domain Controller.

The current setup is Router (ubiquiti USG-3P) is the DHCP server.  
Pihole serves DNS queries for all clients of all O/S's.

Want: Windows Active Directory to be access by new Windows 10/11 clients to be able to join.

If I setup the new clients' DNS to point directly to the Active Directory, it will successfully join. But once I put them back on the PiHole DNS, queries/joins fail.

The Windows server with AD has Windows DNS setup, and those have forwarders set to PiHole, which I think isn't ideal as it could create a "loop". However, if Pihole is setup to "conditionally forward" DNS queries, AD should reply and that will be good.

I've tried the Conditional Forwarding in PiHole as follows:

LocalNetwork IN: 192.168.1.0/24  
domain: myhomedomain.home  
address of your DHCP server: 192.168.1.1

Other things that I've tried:

1. remove (uncheck) the conditional forwarding settings  
then use custom upstream and added the Windows AD server IP (192.168.1.17)

Another try was:  
add the AD to /etc/hosts as ad.myhomedomain.home ad

Thank you.

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 26, 2022, 3:42am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/2 "2022-10-26T03:42:13Z")

</div>

Why don't you try to use Pi-hole as Upstream DNS for your Windows Active Directory Server?

---

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [October 26, 2022, 3:47am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/3 "2022-10-26T03:47:56Z")

</div>

Thanks for your help.

You mean to use Custom DNS and set the IP address of my Windows AD?

 ![Screen Shot 2022-10-25 at 8.45.59 PM](https://discourse.pi-hole.net/uploads/default/original/3X/8/c/8cadba7a573006d53ac3f16f7434d50118536b8e.png)

If that's what you mean, I did. It didn't work.

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 26, 2022, 3:53am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/4 "2022-10-26T03:53:21Z")

</div>

No...

If I understood correctly, you are trying this:

```auto
Windows Machines -> Pi-hole -> Windows AD Server.

```

I think it would be simpler if you tried:

```auto
Windows Machines -> Windows AD Server -> Pi-hole.

```

---

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [October 26, 2022, 3:58am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/5 "2022-10-26T03:58:31Z")

</div>

Yes, I did understand you.

Your interpretation of what I'm trying to accomplish is correct.

Why do I want this setup? (i.e.

> Windows Machines -\> Pi-hole -\> Windows AD Server

.)  
That's because I can log and control each machine without spreading it out between AD and Pihole for DNS. AD would just do GP auth & management. It's much simpler to know where to look for things long term.

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 26, 2022, 4:23am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/6 "2022-10-26T04:23:03Z")

</div>

I don't have experience configuring an AD server, but I think this is what you are looking for:

> **[Use Pi-hole with Microsoft Active Directory | Vikash.nl](https://www.vikash.nl/use-pi-hole-with-microsoft-active-directory/)**
>
> Vikash Pragmatic IT Solutions. In this blog post I will show you how to use Pi-hole with Microsoft Active Directory and Windows Server 2019.

Note:  
The Pi-hole version used on this post is a little old. The screenshots will be probably different than your system.

---

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [October 26, 2022, 4:38am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/7 "2022-10-26T04:38:46Z")

</div>

Yup, I Googled and hoped that worked. Sadly, it didn't work.

I also looked at this to no avail:  
[https://www.reddit.com/r/pihole/comments/6o5q0l/pihole\_placement\_in\_a\_domain/](https://www.reddit.com/r/pihole/comments/6o5q0l/pihole_placement_in_a_domain/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [October 26, 2022, 7:51am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/8 "2022-10-26T07:51:16Z")

</div>

Putting your AD server before Pi-hole in your DNS resolution chain will make your AD server the only client of Pi-hole. Without further measures, you won't be able to attribute DNS requests to individual clients that way.

I think your intended original configuration was correct:

```auto
Clients --> Pi-hole -------> public DNS resolvers
               | ^
               +-- via CF --> Windows AD Server -+

```

But your actual _CF_ configuration looks wrong:

> [@okynnor](#):
>
> LocalNetwork IN: 192.168.1.0/24  
> domain: myhomedomain.home  
> address of your DHCP server: 192.168.1.1

I guess that's your router on `192.168.1.1`?  
In your case, that should be your AD's IP address.

If for some reasons you would still need your router to also answer some of the DNS requests relating to local names, you could create a custom _`dnsmasq`_ configuration file for a distinctive second target (i.e. an additional _Conditional.Forwarding_).

---

<div class="post-metadata">

**Author:** ![chrislph](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chrislph/32/32723_2.png) [@chrislph](https://discourse.pi-hole.net/u/chrislph)\
**Post date:** [October 26, 2022, 7:58am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/9 "2022-10-26T07:58:53Z")

</div>

> [@okynnor](#):
>
> AD would just do GP auth & management.

If you do it the way rdwebdesign suggested, that would enable you to revert your AD back to its known working state. Then change the Windows Server's DNS to use _ **only** _ the Pi-hole, and the Pi-hole's upstream DNS to use whatever was previously being used by the Windows server (external DNS or router for DNS). Pi-hole can still be used to block unwanted domains for site-wide benefit, even if you don't see specific clients in there.

Before:

```auto
Clients --> Win Srv --> router or external DNS

```

After:

```auto
Clients --> Win Srv --> Pi-hole --> router or external DNS

```

---

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [October 26, 2022, 3:27pm UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/10 "2022-10-26T15:27:27Z")

</div>

Thanks for your reply.  
That solution is the one that's working HOWEVER, it is not the one I want!  
Why I won't settle on that solution?

1. It doesn't allow to see all the clients activities in the Pihole
2. if Win server is down (i.e. updates or just down), my clients won't be able to connect to the internet anymore
3. the enterprise isn't just a Windows shop (i.e. it has Linux and MacOS too)
4. Someone has [made it work](https://youtu.be/ehKkPRR6PmI) with Sophos firewall

So the better solution still is to "Conditional Forward" or "DNS Request routes". This way, any Windows AD related queries will be routed to it while website or internet requests will be immediately routed by PiHole.

Observation:  
Even though my Windows client is using Pihole DNS servers, it doesn't always seems to work with queries like "ping pihole2" or "ping docker\_containers".

May be I need to better understand how AD works. It seems that a DNS+DHCP handled by PiHole may be better as PiHole will know what machine?

---

<div class="post-metadata">

**Author:** ![chrislph](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chrislph/32/32723_2.png) [@chrislph](https://discourse.pi-hole.net/u/chrislph)\
**Post date:** [November 2, 2022, 9:55pm UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/11 "2022-11-02T21:55:24Z")

</div>

Hey @okynnor I stumbled across this reddit post which may help you. It seems that the first commenter brod33p is doing the same as what you want. He's using a custom dnsmasq config to send AD queries to the DCs and let Pi-hole handle the none-domain queries directly. Worth a look, and some other commenters further down have other input too. Simialr to your earlier reddit post, but this includes some specific steps, files etc

[https://www.reddit.com/r/homelab/comments/kpyqxw/setting\_up\_active\_directory\_with\_pihole\_help/](https://www.reddit.com/r/homelab/comments/kpyqxw/setting_up_active_directory_with_pihole_help/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [November 3, 2022, 9:07am UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/12 "2022-11-03T09:07:52Z")

</div>

> [@chrislph](#):
>
> but this includes some specific steps, files

If that's referring to a few lines in some `/etc/dnsmasq.d/02-custom.conf`:  
That may not be necessary, as it could be achieved by **correctly** configuring Pi-hole's _Conditional Forwarding_. I emphasise **correctly** here, as it would seem to me that **okynnor**'s original attempt was flawed:

> [@Bucking\_Horn](#):
>
> But your actual _CF_ configuration looks wrong:
> 
> > [@okynnor](#):
> >
> > LocalNetwork IN: 192.168.1.0/24  
> > domain: myhomedomain.home  
> > address of your DHCP server: 192.168.1.1
> 
> I guess that's your router on `192.168.1.1`?  
> In your case, that should be your AD's IP address.

So before venturing into custom configs, I'd like to resuggest trying to replace `192.168.1.1` by the respective AD's IP address in Pi-hole's _Conditional Forwarding_ UI.

---

<div class="post-metadata">

**Author:** ![okynnor](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/e274bd/32.png) [@okynnor](https://discourse.pi-hole.net/u/okynnor)\
**Post date:** [November 3, 2022, 9:03pm UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/13 "2022-11-03T21:03:18Z")

</div>

HOLY! It worked, @Bucking_Horn !!  
THANK YOU. So simple and elegant was the solution.

Steps I took to check that it's actually working on the Windows workstation now connected to AD.

1. Did it join the domain without any errors? YES!
2. successfully logged and downloaded GP policies
3. confirmed again by running `gpupdate /force` - _computer policy update has updated successfully._
4. ran ifconfig /all - the DNS was indeed pointing to the two DNS server -- not to AD
5. checked on Pihole to make sure that the new workstation was actually showing on the Pihoile by looking at the Query logs -- YES, it was! (though the name was different from the Windows computer name -- that is: PiHole display : WINU9IAD9EFG6F.mydomain.home and Windows machine full device name: DESKTOP-J7N8GRB.ad.mydomain.home

On point #4, even if it the name don't watch, as long as it is blocking (and it is blocking unwanted ads), I'm happy.

If I missed anything on my domain join confirmation tests, please let me know.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [November 24, 2022, 9:03pm UTC](https://discourse.pi-hole.net/t/pihole-as-primary-dns-with-active-directory/58800/14 "2022-11-24T21:03:59Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.