19. March 2008 11:45
By
Derick Featherstone
In
Networking
This is not one of those letter’s that you see most people blog. It’s short, sweeeet and practical.
Windows server 2008 DNS implements an extra security feature called “query block list”. If you upgrade your Windows 2003 DNS server to Windows 2008 the query block list is disabled. If you install or reinstall a Windows 2008 DNS server the query block list will be enabled.
To see the current status of the query block list use the following command:
dnscmd /info /enableglobalqueryblocklist
1 = Enabled 0 = Disabled
WPAD and ISATAP are two queries that the query block list will block by default. You can remove these entries by executing the following command:
dnscmd /config /globalqueryblocklist wpad isatap
If you rerun this command you will add these entries to the block list. So if you want to block other entries just add your own.
It is also possible to completely disable block listing but I do not advise it. For more information go to the following web site.
http://technet.microsoft.com/en-us/library/cc441517.aspx
a98c881f-cf61-445c-bc7e-c95f2054ee26|1|5.0
Tags: