We are comparing various IPAM solutions, and are considering implementing Windows Server 2012 IPAM, but have some questions…
We currently have two AD forests, each with one AD domain, each comprised of multiple clustered domain controller servers (2008 R2) providing AD, DNS and DHCP services. One team handles almost all DNS/DHCP/IPAM responsibilities manually on these servers, but the AD responsibilities are covered by a different team. We have a decent number of zones, a few DHCP scopes, and a mixture of static/dynamic addresses, including A records, CNAME records (aliases), delegate records (pointing to a GTM, previously GSS), etc.
Can we accomplish the following objectives with the Windows IPAM solution?
A) Relocate IPAM tasks from our domain controllers to a centralized (and isolated for particular administrators) management solution.
- Can we lock down the DNS servers to only allow updates from the IPAM server (keep Active Directory administrators from making manual updates)?
- Does it provide an interface for mass creation of A records (like what can be done with PowerShell on the DNS servers)?
- Is there a way to retain the separation of roles (restrict other Active Directory administrators from making changes on the IPAM server)?
B) Clean up old/unused records and turn on scavenging (long-standing goal, last time scavenging was enabled, we lost many important A records).
- Does it consolidate and/or report on debug logging data from the DNS servers?
- Can it be used to determine last date, frequency and source IP of DNS queries?
- Are there any other ways it might assist in the cleanup/scavenging effort?
- Can it back up data for restoration purposes (recover from accidental record deletion)?
Thank you in advance for your assistance!