How to audit DNS A record if someone delete it

项目
05/04/2010

HOWTO: Set up DNS auditing for records that disappear from the zone
==============================================
1.Enable Directory Service Access auditing in your default Domain Policy:
- open domain security policy
- navigate to Local Policies -> Audit Policy
- Define "Audit directory service access" for success and failure
- Refresh domain policy on all domain controllers
2. Enable auditing on the zone
- open AdsiEdit
- Navigate to the location of your DNS zone
- Right click the zone to audit and choose properties.
- go to the security tab, click the advanced button
- select the Auditing tab and click Add
- for the user or group, type in Everyone
- On the Object tab, select Success and Failure for the following Access
types:
-- Write All Properties, Read All properties, Delete and Delete Subtree
- OK out of the policy and refresh the policy again.
3. When a record is deleted from DNS the following event is logged in the Security
Event log:
Event ID: 566
Source: Security
Type: Success
Category: Directory Service Access
Description: Will post a message similar to following:
Object Name: DC=recordname,DC=domain,DC=domain,CN=System,DC=dcname,DC=domain
Properties: Write Property
Default property set
dnsRecord
dNSTombstoned

==============================================

執行完上述動作後，如果往後有人刪除A記錄，您將可看到看到下列資訊。
範例
================
事件類型: 稽核成功

事件來源: Security

事件識別碼: 566

日期: 2010/3/29

時間: 下午 04:22:01

使用者: HJHROOTadministrator

電腦: W2003RDC03

描述:

物件操作:

物件伺服器: DS

操作類型: Object Access

物件類型: dnsNode

物件名稱: DC=test001,DC=hjhroot.com,CN=MicrosoftDNS,CN=System,DC=hjhroot,DC=com

處理識別碼: -

主要使用者名稱: W2003RDC03$

主網域: HJHROOT

主要登入識別碼: (0x0,0x3E7)

用戶端使用者名稱: administrator

用戶端網域: HJHROOT

用戶端登入識別碼: (0x0,0x537E2)

存取: 寫入屬性

內容:

寫入屬性

Default property set

dnsRecord

dNSTombstoned

dnsNode

其他資訊:

其他資訊 2:

存取遮罩: 0x20

請在 https://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
================

通过

How to audit DNS A record if someone delete it

其他资源