Helpful tips: Monitor DNS events

Helpful tips: Monitor DNS events

SCE OpsMgr component is designed for healthy monitor. For this issue, I think set up auditing for DNS via GPO editing maybe is a better way to monitor it.
The below steps are just for your reference:
1.Enable Directory Service Access auditing in your default Domain Policy:
a) Edit the Domain Security Policy
b) Navigate to Local Policies -> Audit Policy
c) Define 'Audit directory service access' for success and failure
d) Refresh the policy on all Domain Controllers
2. Enable auditing on the DNS zone:
a) Open ADSIEdit (Start, Run, adsiedit.msc)
b) Right-click ADSI Edit, and connect to the DC=DomainDnsZones, DC=<domain>,DC=<top level domain> container.
c) Expand Microsoft DNS, and navigate to the location of the DNS zone
d) Right-click the zone and choose Properties
e) On the Security tab, click the Advanced button
f) Select the Auditing tab, and click Add
g) Under User or Group, type in Everyone
h) On the Object tab, select Success and Failure for access types Write All Properties, Read All Properties, Delete, and Delete Subtree.
3. When a record is changed from DNS, Event ID such as 11166 will be logged in the Security Event Log on the related DC.
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章