We have a Windows 2016 Standard windows server running Exchange enterprise version 2016. We have had two instances where the DNS entry on the NIC card disappears. The behavior is, the "Use the following DNS server Address" is checked and the entries are blank. It appears something programmatically is removing the entered DNS addresses. It occurred on four separate DNS servers. As we know, when the above is checked you cannot leave that field blank if it is done interactively, therefore the programmatic option is possible.
We have Crowd strike installed and and reviewed their logs plus event viewer logs with nothing indicating cause.
If you have any suggestions as to why this might occur or have seen this in the past with an idea of the cause please share.