I would like to be able to allow a specific user to delete DNS records from my Active Directory-integrated DNS zones.
One zone is replicated to all DNS servers on DCs in the domain (so in DomainDnsZones).
Another zone is replicated to all domain controllers in the domain (so in CN=System,CN=MicrosoftDNS,DC= in the domain).
The reverse lookup zones are replicated to all DNS servers in the forests (so in ForestDNSZones).
I've tried adding
All descendant objects to the zone in DomainDnsZones and the appropriate reverse lookup zone in ForestDNSZones. For example, using
Get-Acl on the DomainDnsZone shows (for the specified account):
ActiveDirectoryRights : Delete AccessControlType : Allow InheritanceFlags : ContainerInherit PropagationFlags : InheritOnly InheritanceType : Descendents
but I get ACCESS DENIED when I try to delete a sample record using
Why isn't this sifficient? What else do I need to do?