does a w2003 box record dns requests?

[elmurado]

We have a w2003 box which has several roles including DNS server.
Does it (or can it), keep a record of the requests for lookups? If so where is this enabled?
Thanks

 

[KrzyIrish]

From the dns manager open the properties dialog of the dns server and set up debug logging or from the view menu you can enable the advanced view and you can see the cached lookups on that server. Let me know if this helps you

 

[elmurado]

Thanks KrzyIrish I will check it out. I can see that it doesn't give a report of the originating IP for the request. Is that possible?

 

[KrzyIrish]

I dont think Windows will give you an easy to read visual report like you are looking for. There might be 3rd party software out there that either attaches to your microsoft dns server and does this or that deciphers the diagnostic logs and will give you a report according. I dont know of any but i will add to this post if i find one. The Diagnostic logging should show the originating address but im not positive because i have never had to use the feature. There is a filter by ip address section in there which may be useful if you are trying to single out one computer. Let me know if you need anything else.

 

[elmurado]

Thanks mate. I'm trying to 'track' users net usage before I get time to setup our proxy servers which will do the trick. I don't have permission (yet) to check individual machines for temp files and the like but am working on that. Some of our users have really gone too far we think....I just want to be able to pinpoint anything possibly dangerous. (i know this can be circumvented by going through google etc and linking from there to sites so I'm not relying on it too heavily.)

 

[martyh]

You can disable access to specific sites in Gpol. This won't give you the tracking you want but it will give users a heads up that you are aware of where they are going (or at least appear to be).

Marty
Network Admin
Hilliard Schools