Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A few days ago I was trying to permanently remove root hints from my DNS server. After much ado, I decided to go a different route and am now trying to put everything back as it was. During the original process, I opened ADUC, clicked View>Advanced Features, and then browsed to System> MicrosoftDNS and deleted the folder RootDNSServers. Now in ADUC, I cannot create a folder here to replace the one I deleted.

I can run adsiedit and load DomainDNSZones for my domain. Under there, I see MicrosoftDNS, RootDNSServers, with all of the objects still inside of it. Is there a way for me to undo what I did? Can I recreate these objects in ADUC? Can I do something else to cause them to show back up there?


share|improve this question
up vote 2 down vote accepted

This is because RootDNSServers is not a simple folder, but a LDAP object whose type is dnsZone (not container); so you can create it only using a LDAP editor.

You should launch ADSIEdit, connect to the default naming context, navigate to System\MicrosoftDNS and then create a new object of type dnsZone, naming it RootDNSServers.

enter image description here

share|improve this answer
Probably need to populate the dNSProperty attribute of the object as well, and maybe others? And create the child dnsNode objects. – Shane Madden Apr 11 '12 at 17:16

The container object is of type dnsZone, not a typical container object, so to re-create you'd need to use raw LDAP.

But, I'd say don't worry about attempting to recreate that container. Assuming that all of your DNS serving domain controllers are Windows Server 2003 or newer, they'll instead look to the DomainDNSZones directory partition (which, by the way, is probably where your phantom root hints were coming from in your previous questions!).

Fire up ADSI Edit, and connect to the distinguished name of DC=DomainDNSZones,DC=yourdomain,DC=com. In there, you'll find DC=RootDNSServers,CN=MicrosoftDNS - it contains the standard root hints, and is the only store of root hints that actually matters, assuming that your domain controllers aren't ancient. Don't stress about the deleted hints container.

share|improve this answer
Thanks, great information. It looks like when I removed the root hints from 3 places, there was actually a fourth place to remove them from that I was missing. All DCs here are S2K8R2, so I'm sure as long as this info is in the DomainDNSZones in LDAP, it will continue to work, but a part of me wants to put things back the way they were, just for uniformity sake. Do you know of any way to do so? – TonyD Apr 11 '12 at 17:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.