Permission to create A/PTR DNS records only

Question

question

BojanZivkovic-7448 asked · Feb 25 at 02:09 PM

Permission to create A/PTR DNS records only

Hi, I want to delegate permission to our VMware team to create new A/PTR records (usually when they add new appliances). How granular can I go with this (ideally) without giving them more permissions than they really need? I see authenticated users group has permission to create all child objects in DNS zone - this allows dynamic updates to work properly I guess. Does it mean than any user (by being member of authenticated users group) can create A/PTR records in given DNS zone?

windows-dhcp-dns

· 1

10 |1000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SunnyQi-MSFT · Mar 02 at 05:08 AM

Hi,

Just checking in to see if the information provided was helpful.

If yes, you may accept useful reply as answer, if not, welcome to feedback.

Best Regards,
Sunny

0 ·

Answer 1 · 2021-02-26T08:25:31.603Z

SunnyQi-MSFT answered · Feb 26 at 08:25 AM

Hi,

Thanks for posting in Q&A platform.

Does it mean than any user (by being member of authenticated users group) can create A/PTR records in given DNS zone?

I have tested in my lab and found that even the user is a member of authenticated group, it cannot create A/PTR records in the specific DNS zone.

The option create all child objects in DNS zone is selected default for authenticated users group. It neither related to permission to create A and PTR records in the specific DNS zone nor related to DNS dynamic update.

If the user was granted permission on server level, it will have access to create A and PTR records in the zones which hold by the DNS server.

A record

PTR record

Dynamic Update

Dynamic update enables DNS client computers to register and dynamically update their resource records with a DNS server whenever changes occur. It's a computer behavior.

For more details, please refer to Dynamic Update in the following article:

How DNS Works

Best Regards,
Sunny

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

image-1.jpg (76.1 KiB)

image-2.jpg (189.1 KiB)

image-3.jpg (157.5 KiB)

·

10 |1000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2021-03-02T14:16:15.407Z

BojanZivkovic-7448 answered · Mar 02 at 02:16 PM

I have just completed some tests - standard user with permissions (Read/Create All Child Objects) on forward lookup zone only was able to create A record. I do not want them access other zones but that would be implemented in GUI code with PS Studio anyways where zone name would be hard-coded.

· 1 ·

10 |1000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SunnyQi-MSFT · Mar 03 at 02:01 AM

Thank you very much for your feedback.

You could accept the useful reply as answer if you want to end this thread up. If there is anything else we can do for you, please feel free to post in the forum. Appreciate your understanding. :) Have a nice day!

0 ·

question