A few days ago I was trying to permanently remove root hints from my DNS server. After much ado, I decided to go a different route and am now trying to put everything back as it was. During the original process, I opened ADUC, clicked View>Advanced Features, and then browsed to System> MicrosoftDNS and deleted the folder RootDNSServers. Now in ADUC, I cannot create a folder here to replace the one I deleted.

I can run adsiedit and load DomainDNSZones for my domain. Under there, I see MicrosoftDNS, RootDNSServers, with all of the objects still inside of it. Is there a way for me to undo what I did? Can I recreate these objects in ADUC? Can I do something else to cause them to show back up there?



This is because RootDNSServers is not a simple folder, but a LDAP object whose type is dnsZone (not container); so you can create it only using a LDAP editor.

You should launch ADSIEdit, connect to the default naming context, navigate to System\MicrosoftDNS and then create a new object of type dnsZone, naming it RootDNSServers.

enter image description here

  • 1
    Probably need to populate the dNSProperty attribute of the object as well, and maybe others? And create the child dnsNode objects. Apr 11 '12 at 17:16

The container object is of type dnsZone, not a typical container object, so to re-create you'd need to use raw LDAP.

But, I'd say don't worry about attempting to recreate that container. Assuming that all of your DNS serving domain controllers are Windows Server 2003 or newer, they'll instead look to the DomainDNSZones directory partition (which, by the way, is probably where your phantom root hints were coming from in your previous questions!).

Fire up ADSI Edit, and connect to the distinguished name of DC=DomainDNSZones,DC=yourdomain,DC=com. In there, you'll find DC=RootDNSServers,CN=MicrosoftDNS - it contains the standard root hints, and is the only store of root hints that actually matters, assuming that your domain controllers aren't ancient. Don't stress about the deleted hints container.

  • Thanks, great information. It looks like when I removed the root hints from 3 places, there was actually a fourth place to remove them from that I was missing. All DCs here are S2K8R2, so I'm sure as long as this info is in the DomainDNSZones in LDAP, it will continue to work, but a part of me wants to put things back the way they were, just for uniformity sake. Do you know of any way to do so?
    – TonyD
    Apr 11 '12 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.