I worked in Microsoft support for domains and security from the mid 90s through the launch of Windows 2000. I haven't worked for Microsoft in more than a decad

I worked in Microsoft support for domains and security from the mid 90s through the launch of Windows 2000. I haven't worked for Microsoft in more than a decade and I don't speak for them; I'm just recollecting. Many of you may be too young to remember, but TCP/IP did not really come to dominate corporate networking until the mid-late 90s. Before that, Novell had the IPX/SPX protocol suite and Microsoft had NetBEUI. These protocols solved name resolution via broadcast (although NetBEUI morphed into NetBIOS over TCP/IP [NBT] and gained a server-based name resolver, WINS, which people have the same complaints about). For early adopters of Active Directory, one of the biggest problems they had was that TCP/IP was new to them, and as often happens in corporations, the people who had Windows AD expertise had no authority over their enterprise DNS, and the people who controlled enterprise DNS had no Windows expertise. Support calls due to inability to locate a Windows resource in DNS were some of the most common, and were therefore one of the bigger identifiable costs of supporting Windows. The Windows team had predicted all this (and also predicted that Windows 2000 would be the first introduction of TCP/IP into many smaller corporate networks and therefore they couldn't count on having DNS and DHCP already present), and they built AD-integrated DNS and DHCP and included it with Active Directory. Microsoft didn't invent DNS or DHCP obviously, and of course at the protocol level both of them are insecure. But so was everything else on corporate LANs at the dawn of the internet and for years after. Having AD-integrated DNS and DHCP meant that literally you could boot a server with the Windows 2000 CD and install Windows and during the creation of Active Directory, you could select to have Windows install DNS and DHCP for you, giving you a turnkey TCP/IP network. Windows DHCP could be configured to issue addresses and then take the broadcast name (remember NBT?) and populate DNS with it, making it easy for DNS name resolution to work and solving the other frequent support issue of not being able to resolve names via broadcast on segmented/routed networks. Of course now all this looks hopelessly archaic, but all of the decisions were rational at the time they were made. The problem now is that many Microsoft customers still use the really old features, they can't migrate off them for one reason or other, usually due to compatibility of some obscure app or other, or just due to costs. Of course the "secure" solution to DNS is for an admin to manually create all the records, and use DHCP reservations. Most companies don't want to expend that effort, except for security sensitive machines. In AD, the really critical records (SRV records) have ACLs that protect them from abuse. So mostly client machines get the dynamic DHCP treatment.