Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This has been bugging me for a while.

We all know Active Directory is a LDAP database.

We also know that the Windows DNS service, when running on a domain controller, can store its data in AD instead of plain text zone files, thus taking advantage of AD automatic replication and removing the need for primary/secondary DNS servers.

The question: where and how are DNS data actually stored in Active Directory?

Can they be accessed using LDAP tools such as ADSIEdit?
Is any DNS entry an actual LDAP object?
An attribute in an object?
Something entirely different?

share|improve this question
LDAP is a network protocol. It does not specify how data is stored. So Active Directory has a database the is exposed trough a LDAP interface. – Mircea Vutcovici Dec 18 '12 at 19:04
up vote 15 down vote accepted

Here is an article I found that may get you started. I can never remember the path to the records off the top of my head.

As it mentions basically you can find your DNS information in the AD at this path.


So if you had a domain you would see it at.,CN=MicrosoftDNS,CN=System,DC=example,DC=org

Your questions:

Is any DNS entry an actual LDAP object?

Your zones will have a object class of dnsZone. Under the zone there will be all your records stored as the class dnsNode.

Can they be accessed using LDAP tools such as ADSIEdit?

Yes, fire up adsiedit or ldp and browse to the above location.

share|improve this answer
I'm accepting this answer because it pointed me in the right direction, howewer it isn't completely right: as the article mentions, the cn=MicrosoftDNS,cn=System,<DomainDN> container is used only on Windows 2000 domains; from Windows 2003 onward things are different and you find DNS data in the DomainDnsZones and ForestDnsZones directory partitions (accessible through ADSIEdit by conncting to the LDAP paths "DC=DomainDnsZones,<DomainDN>" and "DC=ForestDnsZones,<DomainDN>"). – Massimo Aug 13 '10 at 8:28
Those are the default DNS application partitions in the directory; they can be changed too (just so you're aware). – Chris S Aug 13 '10 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.