Did you mean this one?
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
if so this one could help.
--please don't forget to upvote
and Accept as answer
if the reply is helpful--
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
In our active directory we are observing very high number of Event Log ID 5156 for dns.exe service which is getting generated from location system32/dns.exe to specific internal IPs. Our active directory server is also our DNS server.
How to identify what is causing this continuous DNS events.
Did you mean this one?
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
if so this one could help.
--please don't forget to upvote
and Accept as answer
if the reply is helpful--