Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. DNS Server.evtx
LogRisk: Caution
  • Windows Server

DNS Server.evtx C:\Windows\System32\winevt\Logs\DNS Server.evtx

DNS Server log: Windows Server DNS service events (startup, zone loading, replication and transfer errors).

Updated on By AltF4 Formation

What it’s for

The “DNS Server” log receives the events of the DNS Server service: a service that will not start, a zone that will not load, a failed zone transfer, a dependency on Active Directory. It exists only if the DNS Server role is installed. The rules common to .evtx files are on the page for the winevt\Logs folder.

What it contains

  • DNS service start and stop.
  • Zone loading, errors and updates.
  • Problems reading Active Directory-integrated zones, for example event 4013: the DNS server is waiting for AD DS to finish starting.
  • Configuration warnings (forwarders, zone transfers).

This log is separate from the dns.log debug log and from the DNS server audit and analytical logs, which record queries or changes.

Risks and best practices

  • Export it before clearing it during an incident.
  • On a domain controller that hosts DNS, cross-reference it with the Directory Service and DFS Replication logs: a 4013 when a controller starts usually comes from AD DS, not from DNS.
  • Events mention zone and host names, so treat copies as sensitive infrastructure data.

Useful commands

Fenêtre de terminal
# Recent errors and warnings (as administrator)
Get-WinEvent -FilterHashtable @{LogName='DNS Server'; Level=2,3} -MaxEvents 30 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message


# Event 4013 (waiting for AD DS)
Get-WinEvent -FilterHashtable @{LogName='DNS Server'; Id=4013} -MaxEvents 10 -ErrorAction SilentlyContinue


# Export a copy before purging
wevtutil epl "DNS Server" C:\Temp\DNSServer.evtx

Format

Binary XML file (.evtx).

Rotation and archiving

Maximum size and retention are set in the log properties or through Group Policy. Export a copy before any purge.

How to read it

Event Viewer, “Applications and Services Logs”, “DNS Server”. Filter by level or event ID. For an exported file, Get-WinEvent -Path.

Report a mistake