20,212 questions
I was able to connect using the server name. The issue was caused by missing Reverse Lookup Zones, which have now been restored.
Access denied to DNS Manager on Azure AD DS.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 57.99999999999999%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDH%3C/text%3E%3C/svg%3E)
Douglas H
0
Reputation points
When trying to access the RSAT DNS tool, I get an "Access Denied" error. This was working before.
Steps tried:
- Reset admin password
- Created a new admin in the AAD DS admin group
- Removed and re-added the PC to the domain
All admins are getting "Access Denied" when trying to access the DNS console.
Windows for business | Windows Server | User experience | Other
{count} votes
-
Ibrahim Tokar 80 Reputation points2025-02-07T21:48:06.9966667+00:00 Step-by-Step Troubleshooting & Fix
- Check If the Admin Account is a "DNS Admin" in AAD DS
Even if you're a Global Administrator, AAD DS requires explicit permissions for DNS management.
Confirm Membership in the "AAD DC Administrators" Group
- Go to Microsoft Entra Admin Center.
- Navigate to Groups > All Groups.
- Search for AAD DC Administrators.
- Open the group and ensure your admin account is a member.
- If not, add yourself and restart the PC.
- Verify RSAT DNS Access via PowerShell
To check if the issue is specific to the DNS Console, try accessing DNS via PowerShell:
powershell KopyalaDüzenle Get-DnsServer- If you get Access Denied, continue with the next steps.
- If it works, the issue is with the RSAT GUI tool, not your permissions. Step-by-Step Troubleshooting & Fix 1. Check If the Admin Account is a "DNS Admin" in AAD DS Even if you're a Global Administrator, AAD DS requires explicit permissions for DNS management. Confirm Membership in the "AAD DC Administrators" Group
- Go to Microsoft Entra Admin Center.
- Navigate to Groups > All Groups.
- Search for AAD DC Administrators.
- Open the group and ensure your admin account is a member.
- If not, add yourself and restart the PC.
powershell KopyalaDüzenle Get-DnsServer- If you get Access Denied, continue with the next steps.
- If it works, the issue is with the RSAT GUI tool, not your permissions.
-
Ibrahim Tokar 80 Reputation points
2025-02-07T21:48:32.82+00:00 - Check DNS Server ACLs (Access Control Lists)
Even if you're an AAD DC Administrator, the DNS server ACLs may have been modified.
To check DNS ACLs:
Open PowerShell as Administrator on a machine that has RSAT DNS.
Run:
powershell KopyalaDüzenle Get-Acl "AD:\CN=MicrosoftDNS,CN=System,DC=yourdomain,DC=com"Check if AAD DC Administrators or your admin account has the proper permissions.
To Manually Reset ACLs:
- Open DNS Manager (dnsmgmt.msc).
- Right-click your domain zone > Properties.
- Go to the Security tab and ensure that:
- AAD DC Administrators and your admin account have Full Control.
- If permissions are missing, add them manually.
- Reauthorize Your Admin Account in AAD DS
If your admin account was recently added to AAD DC Administrators, you may need to reauthorize it.
Open PowerShell as Admin.
Run:
powershell KopyalaDüzenle dsacls "CN=MicrosoftDNS,CN=System,DC=yourdomain,DC=com" /G "AAD DC Administrators:GA"Restart the DNS service:
powershell KopyalaDüzenle Restart-Service DNSReboot your PC and try accessing the RSAT DNS tool again.
- Ensure Kerberos Ticket is Updated
Since AAD DS relies on Kerberos authentication, your ticket might be expired or invalid.
Open PowerShell as Admin and run:
powershell KopyalaDüzenle klist purgeRe-authenticate:
powershell KopyalaDüzenle runas /user:yourdomain\youradminaccount cmd- Try opening RSAT DNS again. 3. Check DNS Server ACLs (Access Control Lists) Even if you're an AAD DC Administrator, the DNS server ACLs may have been modified. To check DNS ACLs:
- Open PowerShell as Administrator on a machine that has RSAT DNS.
- Run:
powershell KopyalaDüzenle Get-Acl "AD:\CN=MicrosoftDNS,CN=System,DC=yourdomain,DC=com" - Check if AAD DC Administrators or your admin account has the proper permissions.
- Open DNS Manager (dnsmgmt.msc).
- Right-click your domain zone > Properties.
- Go to the Security tab and ensure that:
- AAD DC Administrators and your admin account have Full Control.
- If permissions are missing, add them manually.
- Open PowerShell as Admin.
- Run:
powershell KopyalaDüzenle dsacls "CN=MicrosoftDNS,CN=System,DC=yourdomain,DC=com" /G "AAD DC Administrators:GA" - Restart the DNS service:
powershell KopyalaDüzenle Restart-Service DNS - Reboot your PC and try accessing the RSAT DNS tool again.
- Open PowerShell as Admin and run:
powershell KopyalaDüzenle klist purge - Re-authenticate:
powershell KopyalaDüzenle runas /user:yourdomain\youradminaccount cmd - Try opening RSAT DNS again.
-
Ibrahim Tokar 80 Reputation points
2025-02-07T21:48:57.67+00:00 - Reinstall RSAT DNS
If everything else fails, try reinstalling RSAT DNS to reset any local configuration issues.
Open PowerShell as Admin.
Run:
powershell KopyalaDüzenle Get-WindowsCapability -Name RSAT* -Online | Select-String "DNS"If RSAT DNS is installed, uninstall and reinstall:
powershell KopyalaDüzenle Remove-WindowsFeature -Name "RSAT-DNS-Server" Install-WindowsFeature -Name "RSAT-DNS-Server"Restart your PC and test access again.
- Check Event Viewer for Errors
- Open Event Viewer (
eventvwr.msc). - Navigate to Applications and Services Logs > Microsoft > Windows > DNS-Server.
- Look for Access Denied or Policy Errors.
Final Steps
- ✅ Ensure AAD DC Administrators has Full Control over MicrosoftDNS.
- ✅ Reset DNS ACLs if needed.
- ✅ Reauthorize your admin account using
dsacls. - ✅ Clear Kerberos tickets and log in again.
- ✅ Reinstall RSAT DNS if necessary.
If none of these work, let me know what error messages you see in Event Viewer or PowerShell output. 6. Reinstall RSAT DNS
If everything else fails, try reinstalling RSAT DNS to reset any local configuration issues.
Open PowerShell as Admin.
Run:
powershell KopyalaDüzenle Get-WindowsCapability -Name RSAT* -Online | Select-String "DNS"If RSAT DNS is installed, uninstall and reinstall:
powershell KopyalaDüzenle Remove-WindowsFeature -Name "RSAT-DNS-Server" Install-WindowsFeature -Name "RSAT-DNS-Server"Restart your PC and test access again.
7. Check Event Viewer for Errors
- Open Event Viewer (
eventvwr.msc). - Navigate to Applications and Services Logs > Microsoft > Windows > DNS-Server.
- Look for Access Denied or Policy Errors.
Final Steps
- ✅ Ensure AAD DC Administrators has Full Control over MicrosoftDNS.
- ✅ Reset DNS ACLs if needed.
- ✅ Reauthorize your admin account using
dsacls. - ✅ Clear Kerberos tickets and log in again.
- ✅ Reinstall RSAT DNS if necessary.
If none of these work, let me know what error messages you see in Event Viewer or PowerShell output.
-
Douglas H 0 Reputation points
2025-02-10T20:39:58.2266667+00:00 I was able to connect using the server name. The issue was caused by missing Reverse Lookup Zones, which have now been restored.
Sign in to comment