Required DNS Permissions to set up a High Availability Pool and access Microsoft DNS

10/16/2018 8:00 PM

9/4/2025 8:08 PM

Learn more about the required DNS Permissions and steps on how to set up a High Availability Pool and access Microsoft DNS.

Verify ALL prerequisites below when receiving 'Dns server access denied' on the High Availability configuration pool for DNS.

Orion Platform

Prerequisites 

High Availability (HA) 2.0 needs to use a DNS Server Administrator account that is allowed to make changes to the DNS server. With a standalone DNS server, this could be a Local Administrator configured for WMI access.

By default, Administrators are configured to make DNS server management tasks. Within the AD and DNS setup, this would be an account with full DACL with remote WMI management enabled.

Grant access to a non-administrator account for HA 2.0 DNS Management 

The following steps detail how to use a non-administrator account.

Configure DCOM Services

1. Log in to the server where DNS Services are running.
2. Start dcomcnfg.
3. Expand Component Services\Computers, right-click on My Computer, and select Properties.
4. Click the COM Security tab.
5. In the Access Permissions group, click Edit Default. 
6. Add your account, and select the Enable Local Access and Remote Access checkboxes.
7. 
8. In the Access permissions, group click  Edit Limits, add your account, and enable Local and Remote Access.
9. 
10. In the Launch and Activation permissions, click Edit Default, add your account, and Allow all checkboxes.
     
11. In the Launch and Activation permissions, click Edit Limits, add your account, and Allow all checkboxes.
     

Configure access to the WMI root\MicrosoftDNS branch 

One option is to add the user to the DNSAdmin group. Another possibility is to configure permissions to manage DNS using WMI for the newly created user:

1. Log in to the server where DNS Services are running.
2. Start the MMC console and add WMI Control Snapin.
3. 
4. 
5. Right-click snap-in and click Properties.
    
6. In the Security tab, select the root\MicrosoftDNS branch, and click the Security button.
7. Add your account, and Allow:
   • Execute Methods
   • Provider Write
   • Enable Account
   • Remote Enable
     
      
8. Verify the new user you created has DNSAdmin rights on the DNS Security tab.
9. Start dnsmgmt.msc.
10. Right-click Server/Service and view Properties.
     
11. Click the Security tab.
12. Add your account and allow Read/Write and Create/Delete all child object permissions.
13. 
14.  

Note: Please give/allow Read/Write and Create/Delete all child object permissions on the DNS server and to where SW is being hosted as well.

Setup a Virtual Hostname in HA 2.0 

1. Choose the virtual hostname for the pool.

   The hostname cannot contain a dot character.

   Internationalized names are not supported by HA 2.0.

2. Ensure that the virtual hostname is not already used on your network and fill the Virtual Host Name input box.
3. In the next step of the create pool wizard, enter the user name and password that will be used to authenticate WMI connections to the Microsoft DNS server. The User Name can be entered in User Principal Name (user@domain) or Down-Level Logon Name (domain\user) format.

 

To test the connection to a DNS Server with specific credentials, use the wbemtest tool on the Orion server and connect to a machine using a namespace, such as \\remote_hostname\root\MicrosoftDNS. 

1. Start > Run > wbemtest.
2. Click Connect.
3. In the Namespace, enter \\<ipaddress of DNS server>\root\MicrosoftDNS.
4. Enter the username and password you are using to set up HA.
5. Click Connect.
6. Click Query.
7. Enter the following Query:

   -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   SELECT Name FROM MicrosoftDNS_Zone

8. You should see the DNS Zones, similar to MicrosoftDNS_Zone=<no key> for each zone.
9. Double click one of the entries to see the zone name at the bottom.