Rule version WDNS-22-000004 · STIG v2 · 2026-08-27
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. The actual auditing is performed by the operating system/network device manager, but the configuration to trigger the auditing is controlled by the DNS server.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
Right-click the DNS server and select "Properties".
Click the "Event Logging" tab. By default, all events are logged.
Verify "Errors and warnings" or "All events" is selected.
If any option other than "Errors and warnings" or "All events" is selected, this is a finding.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
Right-click the DNS server and select "Properties".
Click the "Event Logging" tab. By default, all events are logged.
Select the "Errors and warnings" or "All events" option.
Click "Apply".
Click "OK".