Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

DNS Auditing

Is there a way to view who made DNS record changes? We monitor our DNS servers in SAM but i don't see a widget that shows that.

Find more posts tagged with

Accepted answers

jmodjeski

Log Analyzer can give you this information. All changes on Windows DNS are captured in the Windows Events. Other DNS systems use Syslog.

agomezdevelasco

Event Logs is a great option,

but a second option is with your SAM Module,

* If you already have the SAM DNS template another component that can be added is add a component that is similar to:

Part of the process could be:

Inside one of the Out of the Box SAM templates:

Microsoft Network Policy Server Events Template

And one particular component that should be reviewed as similar example.

Warning: Message with invalid authenticator
Component Type Windows Event Log monitor
Events with DNS Change by Account XYZ
WMI
Log To Monitor: System, Security or Application
Event ID #
User who generate the events
Include events

Recommended to test initially as a separate/individual component, and once that be running you can added to your actual template.

SAM component monitors

documentation.solarwinds.com/.../sam-component-monitor-types-sw3188.htm

All comments