How to Find and Use Windows DNS Server Logs
Summary
A guide to locating and exporting Windows DNS logs, enabling query logging for future investigations, and spotting potential tunneling, generated domains, record changes, and DnsAdmins abuse. It warns that LogTotal uploads are not yet sanitized.
Key points
- The DNS-Server Analytical channel records queries and responses but is off by default; enabling it does not recover historical queries.
- The Audit channel records zone and record changes, while the DNS Server log contains service events. The debug log is a text file that can overwrite older entries.
- The article provides wevtutil commands to enable Analytical logging and export DNS event logs.
- Long random-looking query subdomains, repeated NXDOMAIN responses, and high volumes of TXT queries can indicate DNS tunneling or domain-generation activity.
- Unexpected DNS record changes and a plugin DLL loaded by the DNS Server service are identified as investigation signals, including possible DnsAdmins abuse.
- LogTotal does not sanitize EVTX files; DNS logs may contain internal hostnames and client IPs. The article recommends approval before uploading production logs and describes conversion to JSONL as a sanitization option.
- Server logs identify the client IP making a query; endpoint logs such as Sysmon event 22 can help identify the process.
Article Details
- Defense Focus
- Collect and review Windows DNS server and endpoint telemetry to detect suspicious DNS activity and record changes.
- Detection Methods
- Review DNS query and response logs for long, random-looking subdomains, high volumes of TXT queries, or repeated NXDOMAIN responses from one client.
- Review DNS audit events for record creation, deletion, or modification outside approved change windows, including unexpected WPAD records.
- Investigate events indicating that a plugin DLL was loaded by the DNS Server service.
- Data Sources
- DNS-Server Audit channel
- DNS-Server Analytical channel
- DNS Server service-level events
- DNS debug log
- Sysmon event 22
- DNS Client log
- Firewall or proxy logs
- Network sensor telemetry
- Platforms
- Windows Server
- Event Viewer
- LogTotal
- Defensive Actions
- Enable the DNS-Server Analytical channel for future query and response logging; it is off by default and provides no history from before it was enabled.
- Export relevant EVTX logs with an elevated prompt. Read Analytical logs with PowerShell Get-WinEvent using -Oldest.
- Copy the DNS debug log promptly because it overwrites older entries when it reaches its size limit.
- For investigations of past activity, supplement server logs with endpoint, firewall, proxy, or network-sensor data.
- Treat uploaded DNS logs as potentially sensitive because they contain internal hostnames and client IPs; obtain data-handling approval or convert EVTX to JSONL for sanitization first.
MITRE ATT&CK
T1071.004 · DNSThe article identifies command-and-control over DNS as a behavior covered by Prime Core DNS detection rules.T1568.002 · Domain Generation AlgorithmsThe article identifies domain-generation algorithms as a behavior covered by Prime Core DNS detection rules and describes detecting clients making many failed lookups.