This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(249.60000000000002, 72%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAY%3C/text%3E%3C/svg%3E)
In our active directory we are observing very high number of Event Log ID 5156 for dns.exe service which is getting generated from location system32/dns.exe to specific internal IPs. Our active directory server is also our DNS server.
How to identify what is causing this continuous DNS events.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Did you mean this one?
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
if so this one could help.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Hello Dave
Thankyou for the response.
I got how the event is being generated. However, is it normal to have the dns event being generated for the same client IP almost every second. In what scenario could it happen?
No, the auditing is not turned on normally. If you wanted to turn off, then check the second link I provided above.
--please don't forget to upvote and Accept as answer if the reply is helpful--
I do not want to turn off auditing. I want to understand why there are continuous DNS related event with event ID 5156 for a specific client server from my AD/DNS server.
Maybe you can reach out to the colleague that set up the auditing. In my opinion it is not needed.
--please don't forget to upvote and Accept as answer if the reply is helpful--
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 96%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGJ%3C/text%3E%3C/svg%3E)
hi Avinash, have you found the answer? I am encountering the same problem
