I was instructed by one of the teams to get a "tsigSecret" for one of our DNS Zones in favor of dynamic updates. This is being used by ExternalDNS. I cannot find how to extract\create it anywhere. All I found was this age-old article from Microsoft that says:
"To see the TKEY and TSIG records being passed across the network, you can use Network Monitor. Versions 6.12 and later decode the resource records."
I used pktmon to grab the Secure Updates packets but I saw nothing resembling of a key of some kind.