On the main DC (windows server 2008 R2 standard) in our network I have to clear some old DNS entries every now and then in the Forward and Reverse Lookup Zones. I have set the server Aging/Scavenging settings to Scavenge stale resource records, with both the No-refresh interval and Refresh interval to 5 days.

Every now and then I still have to log on to the sever and remove the old DNS entries for computers that are not part of the domain anymore or have been renamed.

Is there a different (better) way to automatically remove these old entries?

  • 1
    Scavenging should do just that. Are those records static records, or are they not older than 10 days yet? Also check permissions on the record. Do you have an AD account for dynamic DNS updates from DHCP that is member of the group DNSUpdateProxy? – Ansgar Wiechers Sep 21 '12 at 12:02
  • No the records are not static, and yes some entries was older than a year(i deleted them manually). No I do not have a account for the 'DNSUpdateProxy' group, Is there a specific user that has to have full control over the the records? – jmtheron Sep 25 '12 at 9:58

For dynamic DNS updates from DHCP you can specify a service (domain) account (see screenshot). The account doesn't need any particular permissions other than being a member of the group DNSUpdateProxy. I usually create a dedicated account, make DNSUpdateProxy the account's primary group and remove all other group memberships.

Credentials for dynamic DNS updates

See if that helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.