Adding our domain controller as an AD DNS connection. The test fails with a 401 for one account, and for a read-only audit account it says “Cannot connect to CIM server. Access denied”. What does the account actually need on the DC?
ZoneRails talks to Windows DNS over WinRM. Use the DC’s hostname or IP, port 5986 (WinRM HTTPS, the default) with HTTPS checked, and domain credentials. WinRM must be enabled on the DNS server; run winrm quickconfig there if it isn’t.
A DOMAIN\user or user@domain name signs in with NTLM; a bare name uses Basic authentication.
To make changes, the account needs to be able to change DNS on that server, for example as a member of DnsAdmins.
For a read-only account, it needs three things on the DNS server:
- Membership of Remote Management Users for WinRM access. Without it the test reports the sign-in was refused (401).
- Read on the DNS server in DNS Manager → server Properties → Security.
- Enable Account and Remote Enable on the WMI namespaces
Root\Microsoft\Windows\DNSandRoot\MicrosoftDNS(wmimgmt.msc → WMI Control → Properties → Security). Without these you get “Cannot connect to CIM server. Access denied”.
Changes through a read-only connection are refused by Windows, ZoneRails shows the refusal, and nothing is recorded as done.