How To Find Source Of Active Directory Integrated DNS Record Deletion
Query King | Thu, 31 Aug 2017 at 14:24 hours | Replies : 4 | Points : 100
Category : DNS
Hi,
I am using Active Directory integrated DNS on Windows 2008 R2 Server. Recently we have found that some DNS records were missing from DNS. Please suggest how to find source DNS record Deletion or how to enable for future tracking.
This Question is already solved Click To See The Answer
Hi,
Please check the Windows Security Log on domain Controller for event 4662. It contains the information about Changes on Active Directory Objects.
you need to look for "DNSNode" object type.
Hi Santosh,
Thanks for response but I am unable to find event log 4662. Please suggest how to enable the logging.
Hi Query King,
Find the given steps to enable auditing.
- Enable Directory Service Auditing.
- Login into Any Domain Controller.
- Click Start go to Administrative Tools and click on Group Policy Management.
- Expand your Domain and select Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.
- Expand Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Audit Policy.
- Right-click Audit directory service access, and then click Properties.
- Select the Define these policy settings check box.
- Under Audit these attempts, select the Success, check box, and then click OK.
2. Enable DNS Auditing on DNS Zone.
- Go to Run and Type ADSIEdit.msc
- In opened windows. Right Click on ADSI Edit and select Connect to…
- Select Default naming context → Expand DomainDNS object with the name of your Domain → System then Right Ñlick on MicrosoftDNS and click on Properties.
- Now in Security Tab, click on Advanced → Auditing (Tab) → click on Add.
- Enter "Everyone" and click on OK.
- In permission windows, Select/check on "Success", in front of Write all properties, Delete, Delete subtree options.
- select "This object and all descendant objects", In Applies to option,
- Click "OK".
3. Verify if Audit Logs are Generating in Windows Security Log.
- Start Event Viewer and open Security Logs.
- Search for Event Log 4662.
- If you are able to see Event Log 4662, where Object Type is dnsNode then its configured now.
Hi Santosh,
Sorry for delayed response, Thanks, now I am able to see Event 4662 in Security logs and able to find deletion source.
