How To Find Source Of Active Directory Integrated DNS Record Deletion
Query King | Thu, 31 Aug 2017 at 14:24 hours | Replies : 3 | Points : 100
Category : DNS
I am using Active Directory integrated DNS on Windows 2008 R2 Server. Recently we have found that some DNS records were missing from DNS. Please suggest how to find source DNS record Deletion or how to enable for future tracking.
Hi Query King,
Find the given steps to enable auditing.
- Enable Directory Service Auditing.
- Login into Any Domain Controller.
- Click Start go to Administrative Tools and click on Group Policy Management.
- Expand your Domain and select Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.
- Expand Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Audit Policy.
- Right-click Audit directory service access, and then click Properties.
- Select the Define these policy settings check box.
- Under Audit these attempts, select the Success, check box, and then click OK.
2. Enable DNS Auditing on DNS Zone.
- Go to Run and Type ADSIEdit.msc
- In opened windows. Right Click on ADSI Edit and select Connect to…
- Select Default naming context → Expand DomainDNS object with the name of your Domain → System then Right сlick on MicrosoftDNS and click on Properties.
- Now in Security Tab, click on Advanced → Auditing (Tab) → click on Add.
- Enter "Everyone" and click on OK.
- In permission windows, Select/check on "Success", in front of Write all properties, Delete, Delete subtree options.
- select "This object and all descendant objects", In Applies to option,
- Click "OK".
3. Verify if Audit Logs are Generating in Windows Security Log.
- Start Event Viewer and open Security Logs.
- Search for Event Log 4662.
- If you are able to see Event Log 4662, where Object Type is dnsNode then its configured now.