Return
-
Title
I want to better understand the "Primary Server Changed" DNS event -
Description
I see multiple events that show "Primary Server Changed" How is this being determined? I have found and entry in the event reference guide, but the description is not clear "Created when the primary server in the SOA has changed in the zone." all zones are Active Directory Integrated Primary zones -
Cause
For AD integrated DNS zones, each forward and reverse lookup zone has a SOA record. In each of those SOA records, there is a "primary server" that is the assigned "owner" or "authority" for the SOA record. If that field is updated in the SOA record, that generates that event. Essentially, it means that the server that is responsible for the SOA has changed, kind of like when you move the PDC Emulator role in AD.We have this event disabled by default because it is noisy for people who run AD integrated zones, the SOA records will bounce back and forth between domain controllers as things do in a multi-master environment. Essentially whichever server last accepted a "write" command to the SOA record becomes the new "Primary Server" (this is expected behavior).
-
Resolution
This event class is typically disabled by default as it is noisy and provides little to no meaningful information. You can safely ignore these messages if you are seeing them, or simply re-disable that event class in the auditing settings.