We have Windows 2008 Dc’s in domain and I have configured DNS auditing for a zone stored in DomainDNSZones partition.
In first step I configured “Default Domain Controllers Policy” to define “'Audit directory service access” for success and failure .
Then enabled auditing on the DNS zone stored in DomainDNSZones partition, using DN “DC=DomainDNSZones,DC=<domain name>.
Under CN=MicrosoftDNS you will find DC=< zone name> Right click on that and select Properties.
Select the Auditing tab, and click Add then Under User or Group, type ‘Everyone’ and click on Check Names button. Click OK.
On the Auditing Entry window that pops up, under the Object tab, select Success and Failure for access types Write All Properties, Delete, and Delete Subtree and click Ok.
But still it’s not working for me, is there any other configuration apart of this, which I need to configure.
I also went through article http://blogs.technet.com/b/networking/archive/2011/08/17/tracking-dns-record-deletion.aspx
