I have an issue where records are 'disappearing' from my primary DNS zone. The client records for these devices are static entries. The entries replicate correctly but get randomly removed. I have tracked the edits back to the PDC with auditing. Where do I go from here?

Here is the setup:

  • 4 Win7 clients connected through VPN to my domain.
  • Three Server 2012R2 DCs; Two at my local site and one on Azure.
  • DNS is integrated into Active Directory.
  • DNS Scavenging is off.
  • "Delete record when stale" is unchecked.

From my searching online I have found an article about disappearing DNS records. Used ASDIEdit to check the Partitions in the Configuration and was able to load the DomainDnsZones and ForestDnsZones as well. I also setup auditing on the DNS entries. This enabled me to track what was making the edits...


Security ID: SYSTEM

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x44936

Directory Service:

Name: example.com

Type: Active Directory Domain Services


DN: DC=computer_name,DC=example.com,cn=MicrosoftDNS,DC=DomainDnsZones,DC=example,DC=com

GUID: DC=computer_name,DC=example.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=example,DC=com

Class: dnsNode


LDAP Display Name: dNSTombstoned

Syntax (OID):

Value: TRUE

Great so I know my DC made the edit. That doesn't tell me why and leaves me stuck. Any suggestions?

Update: It appears after changing the Zones Dynamic update settings from Unsecure & Secure to Secure only the deletions still occur.

I am looking into the possibility of a replication issue at the moment. When I update the PDC static entry, it replicates fine to the second DC but does not replicate to the DC in a seperate site.

  • When you say disappearing, do you mean someone is deleting them? Or something? May 23 '14 at 6:20
  • @Brad Bouchard: OP sees records disappearing and checks the logs. Logs point to the DC making the edits. See blogs.technet.com/b/isrpfeplat/archive/2010/09/23/… for more information on this. Obvious answer would be to disable DNS scavenging, but OP says this is already off.
    – jornane
    May 23 '14 at 7:05
  • Are the systems in question being assigned an IP by DHCP? If so, is the DHCP server configured to delete the DNS records when the lease is up? May 23 '14 at 15:43
  • 1
    Other possibility is that one of the DNS servers still has scavenging turned on. Note there are scavenging settings at the zone level, and also at the server level. Make sure it is disabled everywhere on all servers. Check the Event Viewer of every server for Event ID 2501 to confirm scavenging is not running. May 23 '14 at 15:48
  • 1
    Do you allow non-secure dynamic updates to your Zone? If so, it is possible that something on the client side is messing with DNS. May 23 '14 at 15:50

The solution was given in the comments by msemack. The issue was due to the Dynamic Updates setting on the zone set to Unsecured and Secure rather than Secure only.


Enable the Advanced view (View -> Advanced) and make sure that Delete this record when it becomes stale is not checked in the Properties dialog for the record.

Active Directory manages A and AAAA records for Domain Controllers automatically. This seems to have higher priority than the checkbox. Microsoft has a knowledge base article that describes how you can disable this behaviour. Again, this is only relevant if the affected records belong to a DC.

This article also lists some possible causes for the problem you are describing.

  • Sorry, i forgot to mention that setting is unchecked in my post. I'll add that now.
    – Byron C.
    May 22 '14 at 23:26
  • I changed my answer. Are the records by any chance records for DCs? If not, then I would have to Google this myself as well.
    – jornane
    May 22 '14 at 23:27
  • No just happening with Win7 clients.
    – Byron C.
    May 22 '14 at 23:28
  • I found an article that lists some possible causes.
    – jornane
    May 22 '14 at 23:31
  • Yes, I have worked through that blog as well. Scavenging isn't on, there are no duplicate DNS zones and I performed the suggested Auditing. Its working but I don't know what to do with the information that 'SYSTEM' is deleting my DNS records.
    – Byron C.
    May 22 '14 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.