AD-integrated DNS: securing zones, dynamic updates and the DnsAdmins group

A service stored in the directory

In an Active Directory-integrated zone, each name is a dnsNode object stored in an application partition (DomainDnsZones or ForestDnsZones) and replicated with the rest of the directory. This brings multi-master replication and fine-grained control over who can create or modify a record. It also means DNS security is decided by directory access control lists, not just in the DNS console.

Dynamic updates: "secure only"

A zone can accept dynamic updates in three ways: none, nonsecure and secure, or secure only. A zone that accepts nonsecure updates lets any device on the network, even an unauthenticated one, register or overwrite a name. That is an open door to traffic redirection. Every AD-integrated zone should be set to secure only.

With secure updates, the account that creates a record becomes its owner, and only that account can modify it afterwards. One exception to be aware of is the DnsUpdateProxy group. Records created by its members, often DHCP servers, have no protected owner and can be taken over by anyone. It is better to configure the DHCP service with a dedicated account for updates than to add it to this group.

Any authenticated user can create records

By default, authenticated users have the right to create child objects in an AD-integrated zone. This is what allows a workstation to register itself. A lesser-known consequence is that any domain account can create a name that does not yet exist, by going straight through LDAP rather than the DNS protocol. This technique is often referred to as ADIDNS abuse.

An attacker with nothing more than a standard user account can therefore create a name that workstations look up but that is missing from the zone, and point it to a machine under their control in order to capture authentication attempts. Two cases are particularly sensitive:

• WPAD: the name used by automatic proxy discovery. Windows DNS Server blocks it by default through its global query block list, which also contains isatap. Check that the list is still enabled and has not been emptied to "fix a problem";
• the wildcard record (*): if created, it answers every query for a name that does not exist in the zone, potentially diverting a large amount of traffic.

Possible measures: restrict the create child objects right on zones to the accounts that genuinely need it (testing the impact on workstation registration), create sensitive names yourself so they cannot be claimed, and monitor the creation of dnsNode objects by user accounts.

DnsAdmins: a Tier 0 group in disguise

The DnsAdmins group allows administration of the DNS service. That service runs on domain controllers with system privileges, and its configuration notably allows a plug-in library to be loaded at start-up. In practice, a DnsAdmins member can therefore get code executed on a domain controller. Microsoft considers this behaviour to be by design: it is up to you to treat the group as privileged.

We recommend keeping DnsAdmins empty or restricted to Tier 0 administrative accounts, monitoring any change to its membership, and reviewing permissions on the MicrosoftDNS object and the zones, which grant equivalent control.

Scavenging and zone hygiene

Scavenging removes dynamic records that have not been refreshed for a given period. Without it, zones accumulate names of machines that no longer exist, which skews inventories and can cause resolution confusion. It must be enabled on both the zones and at least one server, with intervals consistent with DHCP lease durations. Static records are not affected. Take the opportunity to check that zone transfers are disabled or limited to explicitly named servers.

What an audit checks

• The dynamic update mode of each zone, and the absence of zones accepting nonsecure updates.
• Permissions to create child objects on AD-integrated zones.
• The presence of wildcard or WPAD records and the state of the global query block list.
• Records owned by user accounts.
• Membership of the DnsAdmins and DnsUpdateProxy groups.
• Scavenging and zone transfer configuration.