The Windows DNS Server log must be enabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259337 | WDNS-22-000004 | SV-259337r960879_rule | CCI-000169 | medium |
| Description | ||||
| Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. The actual auditing is performed by the operating system/network device manager, but the configuration to trigger the auditing is controlled by the DNS server. | ||||
| STIG | Date | |||
| Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide | 2025-02-25 | |||
Details
Check Text (C-259337r960879_chk)
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
Right-click the DNS server and select "Properties".
Click the "Event Logging" tab. By default, all events are logged.
Verify "Errors and warnings" or "All events" is selected.
If any option other than "Errors and warnings" or "All events" is selected, this is a finding.
Fix Text (F-62984r939715_fix)
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
Right-click the DNS server and select "Properties".
Click the "Event Logging" tab. By default, all events are logged.
Select the "Errors and warnings" or "All events" option.
Click "Apply".
Click "OK".