Question : Can you determine 'when' a DNS entry was added in AD

I would like to know when a DNS entry was added into our Active Directory domain. No one is owning up to it, so I would like to have a date/time to aide in trying to figure-out the 'who.'

Answer : Can you determine 'when' a DNS entry was added in AD


Okay, well, it can be in one of three different places. I wanted to avoid giving you instructions for each, hence the question about the replication scope :)

Not to worry :)

1. If the Replication Scope is set to All Domain Controllers in the AD Domain:

a. Open ADSIEdit.msc (Start, Run)
b. Check if "Default Naming Context" or "Domain" are listed. If neither are listed then:
  i. Right click on "ADSI Edit"
  ii. Under Name enter "Domain"
  iii. Under "Select a well known Naming Context" choose "Default Naming Context"
  iv. Click OK
c. Expand "Default Naming Context" or "Domain"
d. Expand "DC=yourdomain,DC=com"
e. Expand "CN=System"
f. Expand "CN=MicrosoftDNS"
g. Select "DC=yourdomain.com"
i. Look for the name of the CNAME in the list (you will not be able to see that it is a CNAME here)
j. Open the Properties for the dnsNode object
k. Look at the whenCreated value

2. If the Replication Scope is set to All DNS Servers in the AD Domain:

a. Open ADSIEdit.msc (Start, Run)
b. Right click on "ADSI Edit"
c. Under Name enter "DomainDnsZones"
d. Select "Select or Type a Distinguished Name or Naming Context"
e. In the box enter "DC=DomainDnsZones,DC=yourdomain,DC=com"
f. Click OK
g. Expand DomainDnsZones
h. Expand DC=DomainDnsZones (again)
i. Expand MicrosoftDNS
j. Follow instructions g to k from 1

3. If the Replication Scope is set to All DNS Servers in the AD Forest:

a. Open ADSIEdit.msc (Start, Run)
b. Right click on "ADSI Edit"
c. Under Name enter "ForestDnsZones"
d. Select "Select or Type a Distinguished Name or Naming Context"
e. In the box enter "DC=ForestDnsZones,DC=yourdomain,DC=com"
f. Click OK
g. Expand ForestDnsZones
h. Expand DC=ForestDnsZones
i. Expand MicrosoftDNS
j. Follow instructions g to k from 1

In the instructions above "DC=yourdomain,DC=com" represents an AD Domain called "yourdomain.com". Every occurrence of this should be replaced with the your own domain name.

Chris
Random Solutions  
 
programming4us programming4us