--- title: "Prerequisites for DNS" canonical: "https://docs.infoblox.com/space/UniversalAssetInsights/1835991066/Prerequisites%20for%20DNS" format: markdown --- To configure a Discovery Job to manage Windows based DNS from the Infoblox Portal credentials for an AD User must be added to the Infoblox Portal. The user(s) must be added to the appropriate AD groups, and have the following permissions as listed below: - DNS Admins - Domain Users - Remote Management Users > ℹ️ Administrators can control and reduce the number of zone objects synchronized by configuring zone-level access permissions in the Microsoft environment. The following permissions must also be added in each instance where the DNS service is hosted on a Windows Member server: - Local Administrator (on the Windows Member server) - Full control for the following registry entry: `KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server` ### Configure WMI Permissions for DNS Namespace On each Windows DNS server that will be managed by Infoblox perform the following steps:[DZ1]  1. Access **Run** by searching for Run in the Windows search bar and by clicking **Run**. 2. Run **wmimgmt.msc** by inputting wimimgmt.msc in the **Open:** text field and by clicking **OK**. 3. Right click **WMI Control (Local)**, then click **Properties**. 4. Click the Security tab WMI Control (Local) Properties panel. 5. Expand **Root**, **Microsoft**, **Windows**, then click **DNS** in the list that is revealed. 6. With DNS highlighted, click **Security**. 7. Click **Add** in the Security for `ROOT\Microsoft\Windows\Dns` panel. 8. Type in **DnsAdmins** in the **Enter the object names to select… **text field and click** Check Names**. 9. If DnsAdmins is underlined, the appropriate group was located and selected. Click **OK**. If you are using a different user for the DNS management use case, select that user instead of the **DnsAdmins** group. 10. In the Security for `ROOT\Microsoft\Windows\Dns` panel, select **DNSAdmins **in the Group or Users names field. If you selected a user instead of a user group, select that user instead. 11.    Click the **Allow **checkboxes associated with **Execute Methods** and **Remote Enable** in the** Permissions **field. 12.    Click **Apply**. 13.    Click **OK**. ### Enable WinRM and CredSSP on each Domain Controller Enable Windows Remote Management and Credential Security Support Provider Protocol on each Domain Controller and DNS Server that will be managed by Infoblox via PowerShell commands. 1. Open an Elevated PowerShell console by Searching for **PowerShell** in Windows Search, then by right-clicking **PowerShell** and clicking **Run as Administrator.** 2. In the PowerShell Window, input the following commands: - `Enable-PSRemoting -Force` - `Enable-WSManCredSSP -Role Server` ##  Assign Permissions for DNS Zone Management The following section is only required if you intend to manage zones directly from the Infoblox Portal. If the intended configuration is read-only, skip to the following sub-header. Please note this section utilizes ADSIEdit which directly modifies Active Directory Objects. Misconfiguration can affect DNS or AD replication. Proceed only if you are experienced with ADSIEdit and have a verified backup of your Active Directory. Always make changes on a test or staging system before applying them in production. To configure the permissions required for DNS zone management via the Infoblox Portal perform the following steps on using an windows account with Enterprise Admin rights on a Domain Controller. 1. Open ADSIedit.msc by searching for **adsiedit.msc** in Windows Search and clicking adsiedit.msc in the results. 2. In the ADSI Edit window, right click ADSI Edit, then click **Connect to…** 3. Click the **Select or type a Distinguished Name or Naming Context** bubble under the Connection Point header. Change DC, could have multiple DCs and TLD to appropriate info 4. Input the following distinguished name. Change the text yourdomain and com to the appropriate domain and top-level domain that matches your environment. If your domain has multiple subdomains add those into the distinguished name using the same format of DC= with no whitespace and delineate with a comma. - CN=`MicrosoftDNS,DC=ForestDnsZones,DC=yourdomain,DC=com` - Click **OK**. 5. In the left panel, right-click the distinguished name that was specified. Then, click **Properties**. 6. In the window that is revealed, click the **Security** tab. 7. Near the bottom of the panel, click **Advanced**. 8. Under the table of permission entries click **Add**. 9. In the Permission Entry for MicrosoftDNS window click **Select a principal**. 10.    Search for the DnsAdmins builtin group, or a service user within the DnsAdmins group. Input the correct username or group in the Enter the object name to select… field, then click Check Names via the Select User, Computer, Service Account or Group panel. 11.    If the name becomes underlined the user or user group has been found. Click **OK**. - Validate that the principal is correct, the type is *Allow*, and the Applies to field shows *This object and all descendant objects*. 12.    In the list of Permissions, click the checkboxes associated with **Create all child objects** and **Delete all child objects**. 13.    Additionally, in the list of permissions validate that **Write all properties** has been checked. 14.    Click **OK**. 15.    Click **Apply**. 16.    Wait for the new Permission entry to populate. This process may take a while if your environment contains a large quantity of records and zones. Once the new Permission entry has populated, click OK. 17.    Click **Apply**. 18.    Click **OK**. ## Prepare the Windows Member Server for the DNS Management Use Case On the Windows Member server running the Universal DDI Agent for the DNS management use case PowerShell commands and Group Policy edits are required for the integration with Infoblox and Windows to work. To prepare the Windows Member server to manage Windows DNS Servers, perform the following steps. 1. Open an Elevated PowerShell console by Searching for **PowerShell** in Windows Search, then by right-clicking **PowerShell** and clicking **Run as Administrator.** 2. In the PowerShell Window, input the following commands. (Note, as a reminder these commands must be run on the Windows Member server running the Universal DDI Agent for the DNS management use case. Replace the example IPs of “10.10.10.6,10.10.10.14” with the IPs of the DNS servers you intend to manage with Infoblox. A Single IP or multiple IPs delineated by commas may be used)*:* - `Enable-WSManCredSSP -Role Client -DelegateComputer "10.10.10.6,10.10.10.14"` - `Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.10.10.6,10.10.10.14"` 3. Open the **Local** **Group Policy Editor** by typing gpedit.msc in the Windows search bar. Then, by clicking Edit Group Policy in the results of the search. 4. In the Local Group Policy Editor, navigate to: **Computer Configuration > Administrative Templates > System >Credentials Delegation**. 5. In the list of Credentials Delegation policies, double-click **Allow delegating fresh credentials**. 6. **Enable** the policy by clicking the Enabled bubble. 7. Click the **Show…** button in the Options table. 8. Input the following entries into the table of servers. Replace the example text in the following entries with the appropriate information associated with your environment. The following text: ` and ..`, and `*..` must be replaced with the name of your DNS server, proper domain of the DNS server, and the top-level-domain that your domain is associated with. Additionally, include all DNS servers you intend to manage with Infoblox: - WSMAN/ - WSMAN/.. - WSMAN/*.. - Click **OK** to confirm the addition of the servers. 9. Click **Apply** to confirm the changes to the Policy. 10.    Click **OK**. 11.    Double-click **Allow delegating fresh credentials with NTLM-only server authentication**. 12.    **Enable **the policy by clicking the Enabled bubble. 13.    Click the **Show…** button in the Options table. 14.    Input the following entries into the table of servers. Replace the example text in the following entries with the appropriate information associated with your environment. The following text:` ` and *.`.` must be replaced with the IP of your DNS server, proper domain of the DNS server, and the top-level-domain that your domain is associated with. Additionally, include all DNS servers you intend to manage with Infoblox using the same format of `WSMAN/`. This step is only required if Kerberos is disabled in your environment, or if NTLM is preferred: - `WSMAN/` - `WSMAN/*..` 15.    Click **OK** to confirm the addition of the servers. 16.    Click **Apply** to confirm the changes to the Policy 17.    Click **OK**. 18.    Open a Command Prompt window on the Windows Member server. Search for cmd with Windows Search and click **Command Prompt** in the results. 19.    In the Command Prompt window, input the command `gpupdate /force`.