PowerShell and _MSDCS Recovery

Oh, no! Someone's blatted the _MSDCS zone from DNS! The _MSDCS zone hosts the domain controller locator DNS resource records for all the domain controllers in an Active Directory forest - it's a key part of how clients find domain controller services. This unfortunate deletion has been replicated to all domain controllers. What to do?


Call your friendly, neighbourhood PowerShell! Here's a simple suggestion:

  1. configure all DCs to use a single domain controller as their primary DNS server
  2. use PowerShell to recreate the zone
  3. use PowerShell to make each DC re-register its SRV records to the new zone
  4. restore original DNS settings to DCs


More on step 1...

Make sure you make a note of the existing DNS settings on each DC. Here's a simple bit of PowerShell to collect that information:

(Get-ADForest).Domains | ForEach-Object {

Get-ADDomainController -Filter * -Server $_ | ForEach-Object {

Get-CimInstance -Class Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=TRUE' -ComputerName $_ |

Format-Table PSComputerName,DnsServerSearchOrder -Wrap -AutoSize |

Out-File .\DC_DNS_Settings.txt -Append




We query the forest to get a list of domains. We then get every domain controller for each domain. Each domain controller is queried for the Win32_NetworkAdapterConfiguration class, using Get-CimInstance, and we ask for the DnsServerSearchOrder property which contains a list of configured DNS servers for each IPEnabled adapter. This is then dumped out to a file for future reference.


More on step 2...

Perform the following action on the designated pimary DNS server: 

Add-DnsServerPrimaryZone -ComputerName "dc01.contoso.com" -DynamicUpdate Secure -Name "_msdcs.contoso.com" -ReplicationScope Forest -Verbose


More on step 3...

Use Invoke-Command to remotely restart the Netlogon service on all domain controllers - this will recreate the necessary DNS resource records:

(Get-ADForest).Domains | ForEach-Object {

Get-ADDomainController -Filter * -Server $_ | ForEach-Object {

Invoke-Command -ComputerName $_ -ScriptBlock {

Restart-Service Netlogon






Test, check and tidy-up. Be patient!

"...How poor are they that have not patience!
What wound* did ever heal but by degrees?
Thou know'st we work by wit, and not by witchcraft;
And wit depends on dilatory time..."


*On the subject of wounds, my regular readers may have noticed that I failed to post last Friday, disrupting my usual blogging cadence. This is because of a 'DIY incident'. That's all I'm saying...


Skip to main content