Updating the MasterServer property on all secondary DNS zones using PowerShell

I recently found myself with an interesting issue. Along with the DNS primary zones we host on our DNS servers, we also have a few customers with their own DNS servers for whom we host secondaries of their domains to provide some resiliency. One customer who has a lot of domains setup on our servers recently moved his server to a different site, and with that a different IP address, and as such the Master Servers property on every one of his secondary domains needing updating to the new IP Address.

Unfortunately while you can do many things with PowerShell, or even dnscmd for that matter, it does seem there are some limitations. Try as I might I've been unable to find a way using either system to query DNS for all secondary domains that have a specific Master Server IP address (they have 100+ domains, and that's a fraction of those we maintain, so manually checking wasn't an option!).

Fortunately I found a work around using the registry!

Windows DNS Server stores all non-AD Integrated zone data in the registry by default, and that includes settings relating to Secondary zones. By querying the registry using PowerShell you can do what I was looking for. So for instance, to simply list all domains who have a MasterServer of 1.1.1.1 you can run :

$AllTargetDomains=Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones' |
    ForEach-Object {Get-ItemProperty $_.pspath | Where-Object {$_.MasterServers -eq "1.1.1.1"}}
$AllTargetDomains.PSChildName

Note, you can also change the last line to :

$AllTargetDomains.PSChildName.Count

If you just want to know how many domains were found.

Now, to change the MasterServer property for all zones, in this case to 2.2.2.2, you run the following version. Note, the entire thing can be run as a single line of code.

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones' |
    ForEach-Object {Get-ItemProperty $_.pspath | Where-Object {$_.MasterServers -eq "1.1.1.1"}} |
    ForEach-Object {Set-DnsServerSecondaryZone -name $_.PSChildName -MasterServers "2.2.2.2"}
   
If you re-run the earlier list version of the code you'll see no entries remaining, and if you check the domain within DNS Management you'll find that the Master Servers list has been changed.

Removing a secondary zone from all DNS servers in an AD domain with PowerShell 3.0

Following on from the last blog "Adding secondary zones to all DNS servers in an AD domain with PowerShell 3.0" I'll move on to removing secondary zones from all the DNS servers in an AD domain.

Much of the code is very similar to that used when creating a new secondary, so I won't bother repeating those bits. As before you obviously need to retrieve the current list of DNS servers on the network and then work through the list.

To delete the zone itself we use the command :

    Remove-DnsServerZone -Name $domain -ComputerName $dnsserver -Force

but to add a little complication I also wanted to log the currently configured master server for the zone before deleting it. With that logged if we accidentally delete a zone it's easy to find where it pointed previously and set it up again.

Unfortunately as far as I can find there's currently no way to retrieve this info using PowerShell, so I had to resort to using the old friend of DNS scripting, dnscmd :

    $master=(dnscmd /zoneinfo $domain) -split '[,]' | ? {$_ -like '*addr=*'}
    write-output "Current master server for $domain is $master" | out-file $logfile -append

This retrieves the zoneinfo data for the domain being deleted, grabs the line containing "addr=" which lists the master servers, and then outputs that information to a log file.

You can download the completed script, which includes logging and error trapping, from http://gallery.technet.microsoft.com/Delete-a-secondary-DNS-44fce3eb.

Adding secondary zones to all DNS servers in an AD domain with PowerShell 3.0

One of the advantages of AD Integrated DNS is that adding or editing a zone on one server automatically replicates that action onto all the others, but that only works when the domain is an AD Integrated Primary. If you're dealing with secondary zones that doesn't apply, and things work like they do in a non-AD environment.

Adding a secondary zone needs to be done on each DNS server within the AD domain individually, which if you have a lot of DNS servers could be a lot of work. Add to that the more servers you're working with, the more chance of a mistake being made on one of them.

To get around this I wanted to script a way to create a secondary zone on all the DNS servers at once.

The first step is getting a list of the DNS servers on the domain. You could manually create and maintain a list of servers, but I prefer to assume things will change and get the script to allow for this. To generate a list of DNS servers I use the following :

    $dnserversldap = [ADSI]"LDAP://ou=Domain Controllers,dc=mydomain,dc=co,dc=uk"
    $objsearcher = new-object system.directoryservices.directorysearcher
    $objsearcher.searchroot = $dnserversldap
    $objsearcher.filter = "(objectcategory=computer)"
    $proplist = "name","cn","lastlogon"
    foreach ($i in $proplist){$objsearcher.PropertiesToLoad.add($i)}
    $results = $objsearcher.findall()
    $serverlist = $results.properties.cn

Note, I'm assuming in this example that all DNS servers are also AD DC's and therefore appear in the Domain Controllers OU, if that's not the case for you then you'd need to adjust it accordingly.

$serverlist now contains a list of DNS servers to work with.

From there I can simply use foreach to work through the list, and call the AddDnsServerSecondaryZone cmdlet to add the required secondary as follows :

    foreach ($dnsserver in $serverlist)
    {
        Add-DnsServerSecondaryZone -Name $domain -ZoneFile $zonefile -MasterServers $ipaddr -ComputerName $dnsserver
    }

Since I want this to be runnable at a PowerShell prompt rather than have to edit the script each time, I add the following at the beginning :

    $domain=$args[0]
    $ipaddr=$args[1]
    $zonefile=$domain + ".dns"

which reads in the domain and IP Address arguments passed to the script, and then generates the .dns filename to be used in the command (since secondary zones aren't stored in AD).

You can download the completed script, which includes logging and error trapping, from http://gallery.technet.microsoft.com/Create-secondary-DNS-zone-3793c0d8 since it also maintains the formatting.