2

We would like to delete all the unused resource records from our authoritative nameserver (Windows DNS server on Win2k3). This is an internet facing DNS (not integrated with domain controller) so the aging and scavenging options are not available.

Basically I would like to delete everything that hasn't been requested for 2 months. I can only think of enabling some logging (on the DNS software itself) in order to log all requests. Then after two months I'll parse the log and do a kind of "diff" with the raw zone file in order to figure out the difference and delete the records not present in the log.

My question is whether or not there a better way or tool available to accomplish this?

1 Answer 1

1

We took a non-technical approach to managing stale records. We made a list of all the records and built a spreadsheet with columns like name, IP, owner, last review & comments. We then passed that around to anyone who has system mgmt responsibilities asking them to claim ownership of their records and identify anything that was no longer needed.

Once we had that list, we removed anything that the owners said was not needed and we looked very closely at those with no owner. Most of them could be deleted. Depending on your role and the risk you can absorb, you could take a draconian approach to those unclaimed items. Just remember to save the details before deleting anything.

We now review that every year and update the review date. There could still be extra things in the database, but it is getting better

3
  • We did something like this ourselves once, only to prove the idiots managing our AD environment had so many conflicting records we were unable to use SCCM. Still, a solid approach.
    – songei2f
    Jun 7, 2011 at 18:26
  • We use this method to manage our Windows/AD DNS. We have scavenging in place to deal with the dynamic records and this process for the static entries.
    – uSlackr
    Jun 7, 2011 at 18:30
  • Totally understood. The jackasses I refer to were using static entries and other "unforeseen contingencies" as a reason to dismiss our concerns. We showed them how little they were doing with their own process, if anything at all.
    – songei2f
    Jun 7, 2011 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .