Message

The DNS server has started.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 2
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854779904
  time_created: '2022-04-07T16:56:30.613142+00:00'
  event_record_id: 30
  correlation: {}
  execution:
    process_id: 2320
    thread_id: 2848
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_STARTUP_OK
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server has shut down.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 3
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854779904
  time_created: '2022-04-07T08:38:25.939614+00:00'
  event_record_id: 22
  correlation: {}
  execution:
    process_id: 2780
    thread_id: 2212
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_SHUTDOWN
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server has finished the background loading and signing of zones. All zones are now available for DNS updates and zone transfers, as allowed by their individual zone configuration.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 4
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775824
  time_created: '2022-04-07T08:31:21.436717+00:00'
  event_record_id: 21
  correlation: {}
  execution:
    process_id: 2780
    thread_id: 4540
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_ZONE_LOAD_COMPLETE
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server could not start because it is dependent on the NTDS service which is not started.

Message

The DNS server could not register dependency on %1 service.

Fields

Message

The DNS server could not create a thread.  System may be out of resources. You might close applications not in use, restart the DNS server or reboot your computer.  The event data is the error code.

Fields

Message

The DNS server failed to initialize NetBIOS lookups to support WINSR for reverse lookup zones.  The server will continue to run but will not attempt to perform WINS reverse lookups.  This may be due to an incorrect configuration.  If WINSR lookups are not required, remove WINSR records from zone data files and reload modified zones or restart the DNS server.  If the DNS server should support WINSR reverse lookup, restart the server computer and verify that the WINS/NetBT configuration for TCP/IP client properties on the computer are correctly set.

Fields

Message

The DNS server could not initialize the remote procedure call (RPC) service. If it is not running, start the RPC service or reboot the computer. The event data is the error code.

Fields

Message

The DNS server could not load or initialize the plug-in DLL %1. The event data is the error code returned by the plug-in DLL load or initialization attempt. Please correct the plug-in error that is causing this condition or remove the plug-in from the DNS server configuration.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 150
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9223372036854808576
  time_created: '2021-05-18T21:23:27.038306+00:00'
  event_record_id: 11659
  correlation: {}
  execution:
    process_id: 3880
    thread_id: 444
  channel: DNS Server
  computer: rootdc1.offsec.lan
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_PLUGIN_INIT_FAILED
  Data:
    Name: param1
    Value: .\mimilib.dll
  Binary: fgAAAA==
message: ''

Sigma Rules

• DNS Server Error Failed Loading the ServerLevelPluginDLL
  Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

The DNS server could not create a Transmission Control Protocol (TCP) socket. Restart the DNS server or reboot the computer. The event data is the error code.

Fields

Message

The DNS server could not bind a Transmission Control Protocol (TCP) socket to address %1. The event data is the error code.  An IP address of 0.0.0.0 can indicate a valid "any address" configuration in which all configured IP addresses on the computer are available for use. 
Restart the DNS server or reboot the computer.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 404
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9223372036855824384
  time_created: '2022-04-07T16:59:58.007502+00:00'
  event_record_id: 34
  correlation: {}
  execution:
    process_id: 2320
    thread_id: 4240
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_CANNOT_BIND_TCP_SOCKET
  Data:
    Name: param1
    Value: 169.254.142.31
  Binary: QScAAA==
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server could not listen on Transmission Control Protocol (TCP) socket for address %1. The event data is the error code.  An IP address of 0.0.0.0 can indicate a valid "any address" configuration in which all configured IP addresses on the computer are available for use. 
Restart the DNS server or reboot the computer.

Fields

Message

The DNS server could not create a User Datagram Protocol (UDP) socket. The event data is the error code. Restart the DNS server or reboot your computer.

Fields

Message

The DNS server could not bind a User Datagram Protocol (UDP) socket to %1. The event data is the error code. Restart the DNS server or reboot your computer.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 407
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9223372036855824384
  time_created: '2022-04-07T16:59:58.007280+00:00'
  event_record_id: 32
  correlation: {}
  execution:
    process_id: 2320
    thread_id: 4240
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_CANNOT_BIND_UDP_SOCKET
  Data:
    Name: param1
    Value: 169.254.142.31
  Binary: QScAAA==
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server could not open socket for address %1. 
Verify that this is a valid IP address for the server computer.  If it is NOT valid use the Interfaces dialog under Server Properties in the DNS Manager to remove it from the list of IP interfaces.  Then stop and restart the DNS server. (If this was the only IP interface on this machine and the DNS server may not have started as a result of this error.  In that case remove the DNS\Parameters\ ListenAddress value in the services section of the registry and restart.) 
 
If this is a valid IP address for this machine, make sure that no other application (e.g. another DNS server) is running that would attempt to use the DNS port. 
 
For more information, see "DNS server log reference" in the online Help.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 408
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9223372036855824384
  time_created: '2022-04-07T16:59:58.007504+00:00'
  event_record_id: 35
  correlation: {}
  execution:
    process_id: 2320
    thread_id: 4240
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_OPEN_SOCKET_FOR_ADDRESS
  Data:
    Name: param1
    Value: 169.254.142.31
  Binary: ''
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server list of restricted interfaces contains IP addresses that are not configured for use at the server computer. 
 
Use the DNS manager server properties, interfaces dialog, to verify and reset the IP addresses the DNS server should listen on.  For more information, see "To restrict a DNS server to listen only on selected addresses" in the online Help.

Fields

Message

The DNS server list of restricted interfaces does not contain a valid IP address for the server computer. The DNS server will use all IP interfaces on the machine. 
 
Use the DNS manager server properties, interfaces dialog, to verify and reset the IP addresses the DNS server should listen on.  For more information, see "To restrict a DNS server to listen only on selected addresses" in the online Help.

Fields

Message

The DNS server has bound one or more socket pool sockets to port numbers from port exclusion range %1.

Fields

Message

The DNS server computer currently does not have a DNS domain name.  Its DNS name is a single-label host name with no domain (for example:  "host" rather than "host.microsoft.com"). 
 
You might have forgotten to configure a primary DNS domain for the server computer. 
 
Because the DNS server has only a single-label name, all zones created will have default records (SOA and NS) created using only this single-label name for the server's host name.  This can lead to incorrect and failed referrals when clients and other DNS servers use these records to locate this server by name. 
 
To correct this problem: 
  1) Click Start, and then click Control Panel.
  2) Open System and Maintenance , and then open System. 
  3) Click Change Settings, and then click Change.  4) Click either Domain or Workgroup, and then type the name of the domain or  workgroup you want the computer to join; the domain or workgroup name will be used as your DNS domain name. 
  5) When prompted, restart the computer.
 
After the computer restarts, the DNS server will attempt to fix up default records, substituting the new DNS name of this server for the old single-label name.  However, you should review the zone's SOA and NS records to ensure that they now use the correct domain name of this server.

Fields

Message

The DNS server has detected that the zone %1 has invalid or corrupted registry data.  To correct the problem, you can delete the applicable zone subkey, located under DNS server parameters in the registry. You can then recreate the zone using the DNS console.  For more information, see "Tuning advanced server parameters" and "Add and Remove Zones" in the online Help.

Fields

Message

The DNS server has detected that the zone %1 has a missing or corrupted zone type in registry data.  To correct the problem, you can delete the applicable zone subkey, located under DNS server parameters in the registry.   You can then recreate the zone using the DNS console.  For more information, see "Tuning advanced server parameters" and "Add and Remove Zones" in the online Help.

Fields

Message

The DNS server has detected that for the primary zone %1 its has no zone file name stored in registry data.  You can either update the zone file name or delete the zone and recreate it using the DNS console.  To delete the applicable zone from the registry, locate its subkey under DNS server parameters in the registry.  You can then recreate the zone using the DNS console.  For more information, see "To change a zone file name", "Tuning advanced server parameters" and "Add and Remove Zones" in the online Help.

Fields

Message

The DNS server has detected that the secondary zone %1 has no master IP addresses in registry data.  Secondary zones require at least one master server to act as a source.  You can add or update the IP address for the master server for this zone using the DNS console.  For more information, see "To update the master server for a secondary zone" in the online Help.

Fields

Message

The DNS server could not create zone %1 from registry data.  One or more of the zone registry key values could be corrupted or the zone file is missing. Use the DNS console to replace or repair any corrupted registry key values or confirm that the zone database is available.  For more information, see "Configure zone properties" in the online Help.

Fields

Message

The DNS server zone %1 has invalid or corrupted registry data for %2. Use the DNS console to replace or repair any corrupted registry key values or confirm that the zone database is available.  For more information, see the online Help.

Fields

Message

The DNS server has invalid or corrupted registry parameter %1.  To correct the problem, you can delete the applicable registry value, located under DNS server parameters in the registry.  You can then recreate it using the DNS console.  For more information, see the online Help.

Fields

Message

The DNS server encountered invalid or corrupted forwarder parameters in registry data. 
 
To fix the forwarders: 
	 - connect to or open this server in DNS Manager 
	 - bring up server properties 
	 - open "Forwarders" tab 
	 - reset forwarders information to desired values 
	 - click OK 
 
For more information, see the online Help.

Fields

Message

The DNS server does not have a cache or other database entry for root name servers. 
Either the root hints file, cache.dns, or Active Directory must have at least one name server (NS) resource record, indicating a root DNS server and a corresponding host (A) resource record for that root DNS server.  Otherwise, the DNS server will be unable to contact the root DNS server on startup and will be unable to answer queries for names outside of its own authoritative zones.  To correct this problem, use the DNS console to update the server root hints.  For more information, see the online Help.

Fields

Message

The DNS server is not root authoritative and no root hints were specified in the cache.dns file. 
Where the server is not a root server, this file must specify root hints in the form of at least one name server (NS) resource record, indicating a root DNS server and a corresponding host (A) resource record for that root DNS server.  Otherwise, the DNS server will be unable to contact the root DNS server on startup and will be unable to answer queries for names outside of its own authoritative zones.  To correct this problem, use the DNS console to update the server root hints.  For more information, see the online Help.

Fields

Message

The DNS server did not detect any zones of either primary or secondary type during initialization. It will not be authoritative for any zones, and it will run as a caching-only server until a zone is loaded manually or by Active Directory replication. For more information, see the online Help.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 708
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854779904
  time_created: '2022-04-07T16:56:30.583997+00:00'
  event_record_id: 29
  correlation: {}
  execution:
    process_id: 2320
    thread_id: 2848
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Name: DNS_EVENT_CACHING_SERVER_ONLY
  Binary: ''
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The DNS server has moved the AD-integrated root hint data for all DNS servers in this domain to the %1 directory partition.

Fields

Message

An administrator has changed the type and zone storage options of zone %1. The zone is now type %2. The zone will be stored in the zone file %3.

Fields

Message

An administrator has changed the type and/or Active Directory location of zone %1. The zone is now type %2. The zone will be stored in Active Directory at %3.

Fields

Message

An administrator has changed the zone storage options for zone %1. The zone will now be stored in the zone file %2. [virtualization instance: %3].

Fields

Message

An administrator has moved the zone %1 to a new location in Active Directory. The zone will be stored in Active Directory at %2.

Fields

Message

The DNS server has loaded the scope %1 of zone %2 from file %3 on server %4. [virtualization instance: %5].

Fields

Message

The DNS server has loaded the zone %1 from file %2 on server %3. [virtualization instance: %4].

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 769
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775824
  time_created: '2022-04-07T08:31:20.801344+00:00'
  event_record_id: 19
  correlation: {}
  execution:
    process_id: 2780
    thread_id: 2212
  channel: DNS Server
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  param1: sigma.fr
  param2: 'NULL'
  param3: WIN-FPV0DSIC9O6.sigma.fr
  VirtualizationID: .
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A DNS server plugin DLL has been loaded from location %1 on server %2.

Fields

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 770
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854808576
  time_created: '2021-05-18T21:33:49.548066+00:00'
  event_record_id: 11684
  correlation: {}
  execution:
    process_id: 180
    thread_id: 4116
  channel: DNS Server
  computer: rootdc1.offsec.lan
  security:
    user_id: S-1-5-18
event_data:
  param1: C:\TOOLS\Mimikatz-fev-2020\mimilib.dll
  param2: rootdc1.offsec.lan
message: ''

Sigma Rules

• DNS Server Error Failed Loading the ServerLevelPluginDLL
  Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

The V1 plugin interface has been implemented in server level plugin DLL.

Example Event

system:
  provider: Microsoft-Windows-DNS-Server-Service
  guid: 71A551F5-C893-4849-886B-B5EC8502641E
  event_source_name: ''
  event_id: 771
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854808576
  time_created: '2021-05-18T21:33:49.548062+00:00'
  event_record_id: 11683
  correlation: {}
  execution:
    process_id: 180
    thread_id: 4116
  channel: DNS Server
  computer: rootdc1.offsec.lan
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

Sigma Rules

• DNS Server Error Failed Loading the ServerLevelPluginDLL
  Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

The V2 plugin interface has been implemented in server level plugin DLL.

Message

The V3 plugin interface to select scopes of a zone has been implemented in server level plugin DLL.

Message

The RecursionScope plugin interface to select scope of the DNS server has been implemented in server level plugin DLL.

Message

The CacheScope plugin interface to select scope of the DNS cache has been implemented in server level plugin DLL.

Message

The DNS server has started to unsign the zone %1 on server %2.

Fields

Message

The DNS server encountered an error while unsigning the zone %1. The error code encountered during unsigning was %2.

Fields

Message

The key signing key with GUID %1 of zone %2 has moved to stage %3 of rollover.

Fields

Message

The zone signing key with GUID %1 of zone %2 has moved to stage %3 of rollover.

Fields

Message

The DNS server is being started in authoritative-cache mode %1. In this mode the records will be kept in cache for as long as %2 minutes and the responses from cache will be sent with same authority as that of the original response that led to their caching on this server.

Fields

Message

Negative caching has been disabled on the server %1.

Fields

Message

The DNS server has loaded the scope %1 of server %2.

Fields

Message

The DNS server has loaded the virtualization instance: %1.

Fields

Message

The EDNS option code %1 for scope transaction is invalid or conflicts with the configuration of another EDNS option. The default value i.e. %2 will be used.

Fields

Message

The ScopeOptionValue has been set to %1.  This option ID will be used to pass the scope information to forwarders via an OPT RR.

Fields

Message

Failed to load server level policy %1 of server %2.

Fields

Message

Failed to load zone level policy %1 of zone %3 on server %2.

Fields

Message

Failed to load zone level policy %1 of zone %3 on server %2. The scope %4 used by policy is absent on the zone. Please configure the scope and recreate the policy.

Fields

Message

Failed to load server level policy %1 on server %2. The scope %3 used by policy is absent on the server. Please configure the scope and recreate the policy.

Fields

Message

Failed to load the client subnet %1.

Fields

Message

Failed to load a server level policy of server %1. An error was encountered while trying to access the registry.

Fields

Message

Failed to load a zone level policy of zone %2 on server %1. An error was encountered while trying to access the registry.

Fields

Message

Failed to load client subnets on server %1. An error was encountered while trying to access the registry.

Fields

Message

The zone %1 is configured to accept updates but the A record for the primary server in the zone's SOA record is not available on this DNS server. This may indicate a configuration problem. If the address of the primary server for the zone cannot  be resolved DNS clients will be unable to locate a server to accept updates for this zone. This will cause DNS clients to be unable to perform DNS updates.

Fields

Message

Failed to load Response Rate Limiting parameters on server %1. An error was encountered while trying to access the registry.

Fields

Message

Failed to enable Response Rate Limiting on server %1.

Fields

Message

The EDNS option code %1 for the virtualization instance option is invalid or conflicts with the configuration of another EDNS option. The default value i.e. %2 will be used.

Fields

Message

Failed to load virtualization instance: %1. None of the zones in this virtualization instance will be loaded.

Fields

Message

Failed to read the virtualization instance from registry.

Message

The VirtualizationInstanceOptionValue has been set to %1. This option ID will be used to identify the virtualization instance on the DNS server.

Fields

Message

The DNS server received indication that scope %1 of zone %2 was deleted from the Active Directory.  Since this scope was an Active Directory integrated scope, it has been deleted from the DNS server.

Fields

Message

The V6 plugin interface has been implemented in server level plugin DLL.

Message

The EDNS option code %1 for the DNS data tag is invalid or conflicts with the configuration of another EDNS option. The default value i.e. %2 will be used.

Fields

Message

The DataTagOptionValue has been set to %1. This option ID will be used to store and transmit an opaque 8 byte DNS data tag associated with a DNS node.

Fields

Message

The throttle plugin interface has been implemented in server level plugin DLL.

Message

The CorrelationTagOptionValue has been set to %1.  This option will be included in detailed tracing query and response events.

Fields

Message

The logging plugin interface has been implemented in server level plugin DLL.

Message

The init query plugin interface has been implemented in server level plugin DLL.

Message

Successfully started HTTP server for DNS-over-HTTPS (DoH) server. The DoH server is listening on following URL(s):
%1

Fields

Message

The DNS server could not initialize the HTTP server for DNS-over-HTTPS (DoH) and failed with error code %1lu.

Fields

Message

The DNS server could not create the HTTP server session for DNS-over-HTTPS (DoH) and failed with error code %1lu.

Fields

Message

The DNS server could not register the URL for the DNS-over-HTTPS (DoH) server and failed with error code %1lu.

Fields

Message

The DNS server could not create the HTTP request queue for DNS-over-HTTPS (DoH) and failed with error code %1lu.

Fields

Message

The configuration for DNS-over-HTTPS (DoH) server are:
%1

Fields

Message

The DNS-over-HTTPS (DoH) server has shut down gracefully.

Message

The DNS-over-HTTPS (DoH) server has shut down due to an error and failed with error code %1.

Fields

Message

The DNS server could not open the file %1.  Check that the file exists in the %SystemRoot%\System32\Dns directory and that it contains valid data. The event data is the error code.

Fields

Message

The DNS server could not map file %1 to memory.  Either close other applications that are not in use or reboot the computer to reclaim additional memory for the server to use.

Fields

Message

The DNS server could not find or open the root hints file, Cache.dns, in the %SystemRoot%\System32\Dns directory.  Verify that this file is located in this directory and that it contains at least one name server (NS) resource record, indicating a root DNS server and a corresponding host (A) resource record for that server.  For more information, see the online Help.

Fields

Message

The DNS server could not find or open zone file %1.  in the %SystemRoot%\System32\Dns directory.  Verify that the zone file is located in this directory and that it contains valid data.

Fields

Message

The DNS server was unable to create the path for file %1 in directory %2. The specified path is too long.  Choose a different path.

Fields

Message

The DNS server could not find or open boot file %1.  This file should be called 'Boot' and be located in the %SystemRoot%\System32\Dns directory.

Fields

Message

The DNS server could not create zone %1 specified in file %2 at line %3.  Check that the zone file is located in the %SystemRoot%\System32\Dns directory and that it contains valid data.

Fields