Hi Experts,
I have enabled DNS forwarder auditing by following below MS KB. And Event ID 4657 is getting registered in event viewer.. But the problem is it is not showing who is edited the forwarder's
http://support.microsoft.com/kb/324739
Registry location: "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters"
Regards, Nidhin.CK