Does anyone know if it is possible to audit which DNS addresses are
requested by workstations on a network?
We have a server running ther DNS server which is a master for the
domain. This server also does forward lookups to a DNS server provided
our ISP.
We have the server running with -v option to display activity on the server console and everything works fine.
In the DNS-DHCP console, I have tried looking at both the audit trail
event logs but both only show the DNS service starting and stopping,
is no other information.
In the options property page for the server, the 'Enable Audit Trail'

option is selected and the event log level is set to 'All'.

I don't know if what I am looking for is possible or if something is
set wrong. Any help would be appreciated.


Richard Sleight

Network Admin