How to Switch Amazon WorkSpaces (Windows) to the New DNS After an AD Connector DNS Change Without Rebuilding Them

The Problem

We are replacing our on-premises Active Directory (AD) servers, and the IP addresses of the DNS servers will change. Because of this, we want to change the DNS servers referenced by Amazon WorkSpaces (Windows) to the new ones.
What should we do to make WorkSpaces reference the new DNS servers?

How should I handle this?

Checking the specifications

In a Windows WorkSpace, the IP addresses of the DNS servers used for domain join are stored in the registry value DomainJoinDns. The SkyLightWorkspaceConfigService service running on the WorkSpace reapplies this value to the network adapter. Because the service reapplies the DomainJoinDns value, any manual change to the adapter's DNS settings reverts to the original value.

Also, changing the DNS settings of AD Connector does not automatically update DomainJoinDns on existing WorkSpaces. The AWS documentation[1] describes the following two ways to apply new DNS settings to WorkSpaces:

Before updating the DNS settings of Active Directory, update the DNS settings of the WorkSpaces. (Recommended)
After updating the DNS settings of Active Directory, rebuild the WorkSpaces.

Rebuilding a WorkSpace recreates its root volume (C drive). Installed applications and modified system settings are lost, so this approach has a large impact.

Even if you have already changed the DNS settings of AD Connector first, as in this case, you can switch over by directly updating the registry of each WorkSpace as long as both the old and new DNS servers are running. DomainJoinDns on existing WorkSpaces is not linked to the AD Connector settings. Therefore, there is no need to revert the DNS settings of AD Connector to the old DNS.

Update procedure

1. Check the current settings. Open PowerShell with administrator privileges and run the following command.
   Get-ItemProperty -Path HKLM:\SOFTWARE\Amazon\SkyLight -Name DomainJoinDns

2. Update the DNS server IP addresses one at a time. First, change only the first IP address to the new value. Leave the second one as the old IP address. You may also make the change in Registry Editor (DomainJoinDns in HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SkyLight).
   Set-ItemProperty -Path HKLM:\SOFTWARE\Amazon\SkyLight -Name DomainJoinDns -Value "NewIP1,OldIP2"

3. Apply the settings. Restart the WorkSpace, or restart the service with the following command. If you restart the service, it may take up to about 1 minute for the change to be reflected on the network adapter.
   Restart-Service -Name SkyLightWorkspaceConfigService

4. Verify operation. Use ipconfig /all to confirm that the DNS server has changed. Then run nslookup against the AD domain name and confirm that the new DNS server responds.

5. Update the second IP address. If there are no problems with the first one, change the second IP address to the new value using the same procedure, then apply the settings and verify operation.

6. Check the DNS settings of AD Connector. Confirm that the DNS addresses of AD Connector are the new DNS servers. If there are multiple AD Connectors, check all of them.

Notes

• If you have many WorkSpaces, the documentation also describes a method of applying a Group Policy Object (GPO) to the WorkSpaces OU to distribute the registry change to all of them at once.
• It is recommended not to launch new WorkSpaces for 15 minutes before and after changing the DNS settings.
• It is recommended to perform the work during off-peak hours or a planned maintenance window.
• Stop or demote the old DNS servers only after all WorkSpaces have been updated. Once the old DNS servers are stopped, some WorkSpaces may end up in a state where the registry cannot be updated manually.

References

[1]Update the DNS servers for WorkSpaces Personal

[2]Update the DNS addresses of AD Connector