Okay so I have never seen anything like this. Here's the story.
We have four DNS servers. Let's call them server01-04. server03 is set to be the primary one by DHCP.
Scavenging is disabled everywhere.
What happens is server03 is deleting its own A record from the DNS. If I create the DNS entry, it will stay there until I reload the forward lookup zone (or reloads itself after a few minutes).
Here's the audit log of the creation:
An operation was performed on an object.
Subject :
Security ID: SYSTEM
Account Name: SERVER03$
Account Domain: myfancydomain
Logon ID: 0x323d924
Object:
Object Server: DS
Object Type: dnsNode
Object Name: DC=server03,DC=myfancydomain.se,CN=MicrosoftDNS,CN=System,DC=myfancydomain,DC=se
Handle ID: 0x0
Operation:
Operation Type: Object Access
Accesses: WRITE_DAC
WRITE_OWNER
Access Mask: 0xc0000
Properties: WRITE_DAC
WRITE_OWNER
{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}
Additional Information:
Parameter 1: -
Parameter 2:
And here's the one for the deletion. You can see that it's server03 deleting the record:
An operation was performed on an object.
Subject :
Security ID: SYSTEM
Account Name: SERVER03$
Account Domain: myfancydomain
Logon ID: 0x323d924
Object:
Object Server: DS
Object Type: dnsNode
Object Name: DC=server03,DC=myfancydomain.se,CN=MicrosoftDNS,CN=System,DC=myfancydomain,DC=se
Handle ID: 0x0
Operation:
Operation Type: Object Access
Accesses: Write Property
Access Mask: 0x20
Properties: Write Property
{771727b1-31b8-4cdf-ae62-4fe39fadf89e}
{e0fa1e69-9b45-11d0-afdd-00c04fd930c9}
{d5eb2eb7-be4e-463b-a214-634a44d7392e}
{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}
Additional Information:
Parameter 1: -
Parameter 2:
I have no idea why is this happening. Any ideas?
