PTR deletion

Question

we have one Windows 2016 server with IP 192.168.2.100. The DNS A and PTR record for this server

is configured static. Somehow, the static PTR was deleted. Is there any log to detect why this PTR is deleted or what you think is the cause?

Thank you!

Answer 1

Some ideas here.

https://social.technet.microsoft.com/Forums/windows/en-US/c65fbb8c-9e56-4f6e-b48d-559268eaff59/eventid-520-dnsserveraudit-logs?forum=winserveripamdhcpdns

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

shows the PTR record is deleted from one of Windows DNS server but did not show who deleted. does it mean that server deleted itself

Bottom line is there may not be a clear record of who or what deleted a PTR record.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

There may be several reasons why a static PTR record would be deleted on a Windows server, including:

1. Manual Deletion: The PTR record may have been deleted manually by an administrator or another user with access to the DNS server.
2. Automated script: The PTR record may have been deleted by an automated script that was designed to remove or update DNS records.
3. DNS server software: There could be a bug in the DNS server software that caused the PTR record to be deleted.
4. Security breach: A malicious actor may have gained unauthorized access to the DNS server and deleted the PTR record.

To identify the cause of the deletion, you can check the event logs on the DNS server for any events related to the PTR record deletion. The DNS server logs events in the Microsoft-Windows-DNS-Server-Service/Admin log located in the Event Viewer under the Applications and Services Logs.

You can also check the Windows Security Event Log for any suspicious activity such as logon failures, logon successes, and account management events that may indicate a security breach.

It's also important to check the backup of the DNS Server and see if the PTR record was deleted from there as well.

In addition, it would be a good idea to review any changes that have been made to the DNS server's configuration, including any scripts or automated tools that may have been used to update or manage DNS records.

If you suspect that the deletion was caused by a security breach, it's crucial to take immediate action to secure your DNS server, including changing all credentials, reviewing the security settings, and conducting a thorough security audit of your network.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.