Home
  •  

Microsoft Windows Server DNS Zone Transfer Failed

Microsoft.Windows.Server.DNS.Zone.TransferFailed (Rule)

Alert generating rule for a zone.

Knowledge Base article:

Summary

Domain Name System (DNS) enhances fault tolerance and load balancing by providing for server redundancy. For any given zone, a DNS server can act as a primary master server, which is the authority for a zone, or as a secondary server, which obtains its zone data from the zone's primary master server or another secondary server. This process is known as zone transfer.

Causes

A zone transfer failed.

Resolutions

Check the master DNS server

If a zone transfer for a secondary zone on the local DNS server is failing, check that the zone is configured to use the correct master server.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To check the master server for a secondary zone:

1.On the secondary DNS server, open DNS Manager. To open DNS Manager, click Start, click Administrative Tools, and then click DNS.

2.In the console tree, expand the secondary DNS server, and then expand the folder that contains the zone.

3.Right-click the zone, and then click Properties.

4.On the General tab, confirm that the Master Servers list contains one or more servers that are authoritative for the zone.

5.Click Edit, and then confirm that the IP addresses of the listed servers have been validated.

If the configuration of the zone at the master DNS server appears to be correct, ensure that the master DNS server is functioning properly and that it can be accessed by the secondary DNS server.

Configure authoritative servers

Verify that the master server of the secondary zone is authoritative for the zone and that the master server is configured to transfer the zone to the secondary server.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To configure the master server to transfer the zone to the secondary server:

1.On the secondary DNS server, open DNS Manager. To open DNS Manager, click Start, click Administrative Tools, and then click DNS.

2.In the console tree, double-click the server, and then double-click the folder that contains the zone.

3.Click the zone, click Action, and then click Properties.

4.On the General tab, note the IP address of the server that is listed in Master Servers.

5.In the console tree, right-click DNS, and then click Connect to DNS Server.

6.Click The following computer, type the IP address of the master DNS server, and then click OK.

7.In the console tree, expand the master DNS server, and then expand the folder that contains the zone.

Note: If the zone is not in the folder, the server is not authoritative for the zone. In this case, you must configure the secondary server to transfer the zone from the correct master server.

8.Right-click the zone, click Properties, and then click the Name Servers tab.

9.Confirm that the secondary server is listed with the correct IP address. To correct the list, do one of the following: ?If the secondary server is not in the list, click Add.

If the IP address of the secondary server is incorrect, click the server in the list, and then click Edit.

10.Click the Zone Transfers tab.

11.Ensure that Allow zone transfers is selected.

12.If Only to the following servers is selected, confirm that the secondary server is listed with the correct IP address. To correct the list, click Edit, and then type the DNS name or IP address of the secondary server in IP addresses of the secondary servers.

External

http://technet.microsoft.com/en-us/library/dd349615(v=ws.10).aspx

Element properties:

TargetMicrosoft.Windows.Server.DNS.Zone
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Windows DNS - Zone Transfer Failed

Event ID: {0}
Event Source: {1}
Event Log: {2}

Event Description: {3}
Event LogDNS Server

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.Server.DNS.Zone.TransferFailed" Enabled="true" Target="Microsoft.Windows.Server.DNS.Zone" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>DNS Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/Property[Type="Microsoft.Windows.Server.DNS.Zone"]/ZoneName$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">6523</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">6524</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">6525</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">6534</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.DNS.Zone.TransferFailed.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventSourceName$</AlertParameter2>

        <AlertParameter3>$Data/Channel$</AlertParameter3>

        <AlertParameter4>$Data/EventDescription$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>