Windows 2016 and 1709+ DNS SEC - Zone Load Sign Failure

Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.LoadSignFailure (Rule)

This rule checks for Load Sign failure in zone in Windows Server 2016 and 1709+

Knowledge Base article:

Summary

The DNS server encountered an error signing zone during load. The administrator should review the zone configuration.

Resolutions

The DNS server encountered an error signing zone during load. The administrator should review the zone configuration. Please check if the signing keys are accessible.

Element properties:

Target

Microsoft.Windows.DNSServer.2016.Zone

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Windows 2016 and 1709+ DNS SEC - Zone Load Sign Failure

The DNS server encountered Load Sign failure in the Zone {1} in Server {0}

Event Log

DNS Server

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.LoadSignFailure" Enabled="true" Target="Microsoft.Windows.DNSServer.2016.Zone" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>DNS Server</LogName>

      <Expression>

        <And>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery>EventSourceName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value>Microsoft-Windows-DNS-Server-Service</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery>EventSourceName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value>DNS</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>7666</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/Property[Type="Microsoft.Windows.DNSServer.2016.Zone"]/ZoneName$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.LoadSignFailure.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[1]$</AlertParameter2>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>