Manually creating DNS records for every client and server is impossible in any real‑world environment. Windows uses Dynamic DNS (DDNS) to automatically register and update records for domain‑joined machines.

In this lab, you’ll learn:

• How Windows clients register their own A/AAAA and PTR records
• The difference between secure and non‑secure dynamic updates
• How to configure DNS scavenging to automatically remove stale records
• How to troubleshoot registration failures

When a Windows client joins a domain, it automatically registers its IP address with the DNS server. Here’s the flow:

2.1 What Registers What?

• Windows Domain Controllers – register SRV records and A records for themselves.
• Windows Clients – register A/AAAA records when they get an IP address.
• DHCP Servers – can register records on behalf of DHCP clients (if configured).

Windows DNS supports three update security levels:

3.1 Update Levels

• None – Disables dynamic updates. All records must be manually created.
• Non‑secure and secure – Allows any client to update records. Not recommended – it’s a security risk.
• Secure only – Only AD‑authenticated users can update records. This is the default and recommended setting for AD‑integrated zones.

3.2 Lab – Check and Configure Update Settings

# Check current dynamic update setting
Get-DnsServerZone -Name "corp.lab" | Select-Object Name, DynamicUpdate

# Set to secure updates only
Set-DnsServerZone -Name "corp.lab" -DynamicUpdate Secure

DNS Manager – Dynamic update settings

3.3 How Secure Updates Work

• The client sends a dynamic update request to the DNS server.
• The DNS server checks if the client is authenticated via AD.
• If authenticated, the update is allowed. The client owns the record and can update it later.
• Only the creator of the record can modify it (unless permissions are changed).

Over time, DNS zones accumulate stale records – entries for machines that no longer exist or have changed IPs. Scavenging automatically removes these records based on timestamps.

4.1 How Scavenging Works

• Each dynamic record has a timestamp (set when the record is created or refreshed).
• No‑refresh interval – Time after which the record can be refreshed (default: 7 days).
• Refresh interval – Time after which the record becomes stale (default: 7 days).
• Scavenging removes records that haven’t been refreshed for No-Refresh + Refresh days (default: 14 days).

4.2 Lab – Enable and Configure Scavenging

# Enable scavenging on the server
Set-DnsServerScavenging -ScavengingState $true -RefreshInterval 7.00:00:00 -NoRefreshInterval 7.00:00:00

# Enable scavenging on the zone
Set-DnsServerZone -Name "corp.lab" -ScavengeMode "Automatic"

# View scavenging settings
Get-DnsServerZone -Name "corp.lab" | Select-Object Name, ScavengeMode, DynamicUpdate

DNS Scavenging – Aging configuration

4.3 Scavenging Best Practices

• Set No‑refresh = Refresh (e.g., 7 days each).
• Use DHCP to update records for non‑Windows or DHCP clients.
• Test scavenging in a lab before enabling in production.
• Monitor scavenging using Event Viewer (DNS Server → Operational).

5.1 Force Client Registration

On a domain‑joined Windows client, open PowerShell as Administrator:

# Force registration of all DNS records
ipconfig /registerdns

# Wait a moment, then verify
nslookup CLIENT01.corp.lab
Resolve-DnsName -Name CLIENT01.corp.lab

5.2 Verify Registration in DNS Manager

Open DNS Manager and navigate to your zone. You should see the client’s A record.

Client A record registered in DNS

5.3 Check Record Timestamps

# View record timestamps using PowerShell
Get-DnsServerResourceRecord -ZoneName "corp.lab" -Name "CLIENT01" | Select-Object RecordData, Timestamp

# Or use dnscmd
dnscmd /zoneprint corp.lab | findstr CLIENT01

For clients that aren’t domain‑joined (or for more control), you can configure the DHCP server to update DNS records on behalf of clients.

6.1 Configure DHCP DNS Updates

1. Open DHCP Manager → Right‑click your IPv4 scope → Properties.
2. Go to the DNS tab.
3. Check Enable DNS dynamic updates according to the settings below.
4. Select Always dynamically update DNS A and PTR records.
5. Check Discard A and PTR records when lease is deleted.

DHCP DNS update configuration

6.2 PowerShell Alternative

# Set DHCP scope DNS updates
Set-DhcpServerv4Scope -ScopeId 10.10.10.0 -DynamicDNSUpdate $true -DNSUpdate "Always" -DNSDeleteOnRelease $true

7.1 Common Registration Errors

Error 9005 – “DNS server refused the dynamic update”

• Cause: The zone doesn’t allow secure updates, or the client isn’t authenticated.
• Fix: Set zone to Secure updates. Ensure client is domain‑joined.

Error 9017 – “DNS server was unable to create a record”

• Cause: The record already exists and the client doesn’t have permission.
• Fix: Check ownership of the record or delete it and let the client re‑register.

7.2 Lab – Diagnose Registration Issues

# Check DNS event logs for registration issues
Get-WinEvent -LogName "DNS Server" | Where-Object { $_.Id -in 9005,9017,9018 } | Select-Object TimeCreated, Message

# Check client registration status
nltest /dsregdns /force

# View DNS server statistics
dnscmd /statistics

7.3 Force Re‑registration (Fix)

# On the DNS server, delete the stale record
Remove-DnsServerResourceRecord -ZoneName "corp.lab" -Name "CLIENT01" -RRType A -Force

# On the client, re-register
ipconfig /registerdns

Event Viewer – DNS registration error

Let’s simulate scavenging by adjusting the intervals and running it manually.

8.1 Set Short Intervals for Testing

# Set intervals to 1 day for testing (don't do this in production!)
Set-DnsServerScavenging -ScavengingState $true -RefreshInterval 1.00:00:00 -NoRefreshInterval 1.00:00:00

# Check the settings
Get-DnsServerScavenging

8.2 Manually Start Scavenging

# Start scavenging immediately
Start-DnsServerScavenging -Force

# View scavenging results in Event Viewer
# Applications and Services Logs → DNS Server → Operational
# Look for Event IDs 2000–2010 (scavenging actions)

8.3 Verify Scavenging Results

# Check if stale records were removed
Get-DnsServerResourceRecord -ZoneName "corp.lab" -Name "STALE-CLIENT" -ErrorAction SilentlyContinue

# View all records with timestamps
Get-DnsServerResourceRecord -ZoneName "corp.lab" | Select-Object HostName, RecordType, RecordData, Timestamp

Scavenging operational log – records removed

When a client creates a dynamic record, it becomes the owner of that record. Only the owner can update or delete it.

9.1 View Record Security

# Check ACLs on a specific record (requires DNS Admin rights)
$record = Get-DnsServerResourceRecord -ZoneName "corp.lab" -Name "CLIENT01"
Get-Acl -Path "ad:CN=CLIENT01,CN=MicrosoftDNS,CN=System,DC=corp,DC=lab" | Format-List

9.2 Change Record Ownership

# If you need to take ownership (e.g., a deleted client)
# 1. Delete the record
Remove-DnsServerResourceRecord -ZoneName "corp.lab" -Name "CLIENT01" -RRType A -Force

# 2. Have the new client re-register (or create manually)
Add-DnsServerResourceRecordA -ZoneName "corp.lab" -Name "CLIENT01" -IPv4Address "10.10.10.100"

10.1 Disable Scavenging

# Disable scavenging on the server
Set-DnsServerScavenging -ScavengingState $false

# Disable scavenging on the zone
Set-DnsServerZone -Name "corp.lab" -ScavengeMode "Off"

10.2 Recover Accidentally Deleted Records

# If scavenging deleted important records:
# Option 1: Restore from AD Recycle Bin (if enabled)
# Option 2: Re-register from clients
# Option 3: Restore from DNS backup

# Force all domain controllers to re-register
nltest /dsregdns /force

# Force all domain-joined clients to re-register (via Group Policy or script)

10.3 Reset Scavenging to Defaults

# Reset to production settings (7 days each)
Set-DnsServerScavenging -ScavengingState $true -RefreshInterval 7.00:00:00 -NoRefreshInterval 7.00:00:00

• Dynamic DNS automates record management – no manual entries needed for clients.
• Secure updates (AD‑authenticated) prevent unauthorised record modifications.
• Scavenging keeps your zone clean by removing stale records automatically.
• Proper interval configuration (No‑refresh + Refresh) determines when records are removed.
• DHCP can update DNS on behalf of non‑domain‑joined clients.
• Record ownership matters – only the creator can modify a secure record.
• Event logs and dnscmd are essential tools for troubleshooting.