Hi,
I have scoured the Interweb and tried all suggestions to no avail for this one. Here's the scenario:
My client has a Windows 2008 R2 SP1 (Windows 2003 domain/forest functional level) server which is a DC and DNS server. The problem is that a DNS record for an Exchange 2010 server is getting deleted every 10 or 40 minutes. This started occurring for no obvious reason a few weeks ago. The impact is that users cannot connect to Exchange (caching does not seem to help with this, which is odd). I disabled scavenging, which did not resolve the issue. I enabled auditing and found a 4662 event revealing that the domain administrator account was deleting the server A record (and pointer record). Why this is happening is what I am trying to investigate next: possible bug? The zone is configured as non secure- maybe making it securing it would help? But this does not explain why the record is being deleted. There is no NIC teaming implemented, which I understand can cause issues.
As an interim measure I created a script employing dnscmd that recreates the record every 15 minutes, which works for the most part, but not always, which is why I added a deny permission on the record for the domain Administrators group, seems so far to have prevented the record from being deleted.
Any advise on the cause of this and how to investigate why the record is being deleted will be much appreciated!