How to audit DNS servers using Windows PowerShell and ADAudit Plus

• Identify the DNS server from which you need the information.
• Decide on the parameters to be included in the script. This helps filter the resulting report. For example, the parameter ComputerName helps narrow down the query to specific servers.
• Write the code.
• Compile the script.
• Execute it in PowerShell.
• You can export the resulting report in CSV format by adding the Export-CSV command at the end of the script.
• The script will have to be modified accordingly if it needs to be exported in a different format.

Here is a sample script

Get-DnsServerDiagnostics|Export-Csv -Path "C:\NewFolder\DnsServerDiagnostics.csv" -NoTypeInformation

Here is a sample output:

This script will list all the diagnostic and logging parameters and this will help administrators know which parameters are enabled and disabled.They can then use this information to modify the parameters by using another PowerShell cmdlet.

• In the ADAudit Plus console, click on the Reports tab, navigate to DNS Changes to view reports on the different events associated with the DNS server such as the modified DNS zones, permission changes and so on.
• Select the relevant domain and OU.
• Click Export to export the report in any of the different formats listed (CSV, PDF, HTML, CSVDE, XLSX).

Here is a sample report on permission changes in the DNS server:

This report presents all the permission changes associated with the DNS server that have been made in the time frame chosen. It provides the who, when, where and what of the changes made. This will help administrators trace the source of any unexpected change in permissions, that could be a potential security risk.