We have a single domain in multiple forest environment. I tried to add a record to one of the reverse lookup zones of the domains which is a single domain in the single forest , i didnt have the authority to do so , so i tried to see the properties i couldnt see security tab being a domain admin; Later i added my self to the enterprise admin group, even then i couldnt see security tab and couldnt edit the zone.We have a seperate AD team which manages AD and DNS, but my question is how can they lockout the zones to even enterprise and domain admins? How is it possible? This is a simple matter of request being sent to them any way but i want to know the security mechanics involved.
-> Additional things are there are multiple forests which we have trusts with.
-> Even though you can controll domains DNS thorug external groups via trusts , thus they supercede the forests own enterprise admins or the domain's domain admins?
Please do let me know the questions or clarifications if required.