The DNSAdmin group cannot use Powershell to obtain DNS information

Question

I try to execute the Powershell command to obtain DNS information through the pypsrp library of python. Executing Get-DnsServerResourceRecord through the Domain Admin group can return data, but the Dns Admin group does return empty

1. I added user test1 to DnsAdmin
2. Enable WMI related permissions
3. Use the user to execute Get-AdUser to return data, and execute Get-DnsServerResourceRecord or Get-DnsServer to return empty

May I ask what is the problem? I also assigned the DNSAdmin group the Dns registry to no avail. Only the DomainAdmin group can, but I don’t want to set such a large authority to test1

Answer 1

Hi, fdsfsd zh
This is Chaboon.

I tried executed Get-DnsServerResourceRecord on a Domain Controller, DNSAdmins Group is completed, but only Domain Users Group is not complated. Also , I tried executed Get-ADUser, DNSAdmins Group is completed, and Domain Users Group is complated. I do not configred WMI permissions.

I seem ,you are not necessary to WMI permissions and must be setting "LocalAccountTokenFilterPolicy" registry.

You can see below article :
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction

Regards,

Answer 2

I solved this problem with JEA https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3

Answer 3

I solved this problem with JEA https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3