How to audit DNS A record if someone delete it
HOWTO: Set up DNS auditing for records that disappear from the zone
==============================================
1.Enable Directory Service Access auditing in your default Domain Policy:
- open domain security policy
- navigate to Local Policies -> Audit Policy
- Define "Audit directory service access" for success and failure
- Refresh domain policy on all domain controllers
2. Enable auditing on the zone
- open AdsiEdit
- Navigate to the location of your DNS zone
- Right click the zone to audit and choose properties.
- go to the security tab, click the advanced button
- select the Auditing tab and click Add
- for the user or group, type in Everyone
- On the Object tab, select Success and Failure for the following Access
types:
-- Write All Properties, Read All properties, Delete and Delete Subtree
- OK out of the policy and refresh the policy again.
3. When a record is deleted from DNS the following event is logged in the Security
Event log:
Event ID: 566
Source: Security
Type: Success
Category: Directory Service Access
Description: Will post a message similar to following:
Object Name: DC=recordname,DC=domain,DC=domain,CN=System,DC=dcname,DC=domain
Properties: Write Property
Default property set
dnsRecord
dNSTombstoned
==============================================
執行完上述動作後，如果往後有人刪除A記錄，您將可看到看到下列資訊。
範例
================
事件類型: 稽核成功
事件來源: Security
事件類別目錄: 目錄服務存取
事件識別碼: 566
日期: 2010/3/29
時間: 下午 04:22:01
使用者: HJHROOTadministrator
電腦: W2003RDC03
描述:
物件操作:
物件伺服器: DS
操作類型: Object Access
物件類型: dnsNode
物件名稱: DC=test001,DC=hjhroot.com,CN=MicrosoftDNS,CN=System,DC=hjhroot,DC=com
處理識別碼: -
主要使用者名稱: W2003RDC03$
主網域: HJHROOT
主要登入識別碼: (0x0,0x3E7)
用戶端使用者名稱: administrator
用戶端網域: HJHROOT
用戶端登入識別碼: (0x0,0x537E2)
存取: 寫入屬性
內容:
寫入屬性
Default property set
dnsRecord
dNSTombstoned
dnsNode
其他資訊:
其他資訊 2:
存取遮罩: 0x20
請在 https://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
================