Turn off RPC management of DNS on all DCs
By now you have probably seen:
http://www.microsoft.com/technet/security/advisory/935964.mspx
Microsoft recommends you mitigate the problem by disabling RPC management on DNS. They give the switch to do that, but no script to do it on a large number of DCs or DNS servers.
Here is how you do it on scale:
-
Generate a list of all your DCs or DNS servers. Put it in a file called DCList.txt. You can generate this list by right-clicking the Domain Controllers OU and selecting "Export List..." If you have a more complicated list write a query to get them. Below I show how to do that.
-
Log on as an Enterprise Admin (or a domain admin if you only have one domain)
-
Run this command in the directory where you put the DCList.txt file
for /f %i in (DCList.txt) do reg add
\\%i\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v RpcProtocol /t REG_DWORD /d 4
That's will change the setting. To set it back to the original you would run this command instead:
for /f %i in (DCList.txt) do reg delete \\%i\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v RpcProtocol /f
Both changes require you to stop and restart the DNS service. You can use these commands for that:
for /f %i in (DCList.txt) do sc \\%i stop DNS
for /f %i in (DCList.txt) do sc \\%i start DNS
To generate a list of DCs, you can use the Saved Queries feature of Active Directory Users and Computers. Here is how:
-
Open Active Directory Users and Computers
-
Right-click Saved Queries and select "New Query"
-
Name the query "Domain Controllers" and click "Define Query"
-
In the "Find" dropdown select "Computers"
-
In the "Role:" dropdown select "Domain Controller"
-
Click OK Twice
-
Select the query. You should now see all your DCs in the right-hand pane.
-
Right-click the query and select "Export list..."
-
Save it somewhere as DCs.txt.
-
Alternatively, run "netdom query dc > DCs.txt" on a command line. In that case you need to delete the last line of the file before you run the rest of the command though. Otherwise it will try to set this value on the computer "The".
-
Navigate to that directory. Because the file is tab-delimited you need to modify the command in the for loop slightly to make it work. The following command will parse the file properly and disable RPC management on DNS on all DCs.
for /f "skip=1 tokens=1" %i in (DCs.txt) do reg add
\\%i\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v RpcProtocol /t REG_DWORD /d 4
Using this file the commands to stop and restart the DNS service need to be slightly modified:
for /f "skip=1 tokens=1" %i in (DCs.txt) do sc \\%i stop DNS
for /f "skip=1 tokens=1" %i in (DCs.txt) do sc \\%i start DNS
Hopefully this will help people mitigate this problem a bit faster than having to do manual registry changes everywhere.