AD DNS CLEANUP
Remove stale _msdcs DNS records left behind by a demoted or failed Domain Controller
- Signed Windows executable — no installer
- Unique license key
- Instant email delivery
- Free updates
- Runs on DC or RSAT workstation
▼ AFTER YOU BUY
When a Domain Controller is demoted or fails permanently, it leaves orphaned records in the
_msdcs zone — GUID CNAME aliases, Kerberos/LDAP SRV records,
and delegation NS records that point to a DC that no longer exists. Those stragglers quietly break your
environment: dcdiag DNS Delegation failures, "missing glue A record" errors, KCC replication
topology errors, and wasted DNS lookups on every client. AD DNS Cleanup finds them and lets you
review and remove them — across every DC in the forest — in one session. It also finds what the dead
DC left outside _msdcs: its
NS record and its own A record in your forward zone. That one matters more than it sounds
— while that A record survives, the dead DC's _msdcs
records still resolve, so an ordinary scan reports the zone clean while DNS keeps
handing clients the address of a server that is gone. And when the zone is worse
than dirty — missing or misconfigured entirely — it can rebuild the
_msdcs zone from scratch: re-created AD-integrated and
forest-wide, repopulated, and verified per DC.
DNS HEALTH TEST
Runs dcdiag /test:DNS /v and parses every sub-test — Authentication, Delegations, Records, Forwarders — into a color-coded PASS/FAIL report. 10-minute hard timeout.
STALE SCAN — EVERY DC
Walks every CNAME, SRV, and NS record in the _msdcs zone and flags the orphans. With All DCs ticked it reads every reachable domain controller's copy and marks anything DIVERGENT — present on some DCs and not others, a replication red flag you would otherwise never see.
DEAD-DC LEFTOVERS
Finds the NS and A records a removed DC leaves in your forward zone — the ones that keep resolving to a server that no longer exists, and that hide the _msdcs problem instead of showing it. A host must be named as a DC, live inside the forest, be absent from Active Directory, and look decommissioned before it is listed at all — four tests an ordinary member server or a delegated-zone appliance does not meet. What lands in the grid is a starting point, not a verdict: you read the reason on every row and approve each removal yourself.
CHECK DC NIC DNS
The recommended first step. Reads every domain controller's own network-adapter DNS servers and reports what actually stops records registering: no AD DNS configured, an external resolver like 8.8.8.8, a DC that never points at itself, or a DC whose first DNS server is a partner instead of itself — the legacy habit behind most stubborn dcdiag RReg failures. Every finding comes with its fix.
RE-REGISTER DNS
Forces every live DC to re-register its DNS records right now (nltest /dsregdns) — locally and on remote DCs over WinRM. Refills missing records in an existing zone; the same refresh Netlogon runs at boot.
REBUILD THE _MSDCS ZONE
The recovery button for the worst case — a missing or misconfigured _msdcs zone that dsregdns can't fix. Re-creates it AD-integrated and forest-wide (ForestDnsZones), then repopulates and verifies it, across the forest.
PREVIEW BEFORE YOU REMOVE
A read-only Preview shows exactly what would be removed before anything happens. REMOVE requires confirmation, records every operation PASS/FAIL, and re-scans automatically when done.
STORES WHAT IT CHANGES, VERIFIES, ABORTS ON FAILURE
Before a single record is deleted it stores the existing data in a CSV — zone, name, type, target, TTL, SRV priority/weight/port. If that file cannot be written, nothing is removed. Before any rebuild it stores the existing zone the same way, guards the action behind a double confirmation, and verifies per DC afterward — never reporting success on a half-built zone. These files are for review only. They are not backups and not a recovery service — a current, tested full system backup of the affected domain controllers is your responsibility, and a DNS zone export alone will not undo an Active Directory change.
REQUIREMENTS
- Run as Domain Admin or Enterprise Admin (elevated / UAC)
- ActiveDirectory and DnsServer PowerShell modules
- Best run directly on a healthy DC, or a workstation with full RSAT installed
- WinRM enabled on remote DCs for the Re-register and Rebuild features
SUPPORTED WINDOWS
- Fully tested: Windows Server 2016, 2019, 2022, 2025
- Not supported: Server 2012 / 2012 R2 — end of life and untested
- Workstation: Windows 10 (1809+) / 11 with AD & DNS RSAT tools
WHAT IT WILL AND WILL NOT DO
- Preview is read-only — REMOVE always requires an explicit confirmation
- Stale
_msdcsrecords are judged against live DCs and parent-zone A records; dead-DC leftovers are judged by four separate tests. Both are advisory — you review each row - Scope is DNS only — it does not touch AD computer objects, Sites & Services, or FSMO roles. Record removal covers the
_msdcszone and, when you enable Dead-DC leftovers, the NS and A records a removed DC left in your forward zone - Every removal stores the existing data first, and if that file cannot be written, nothing is removed — for review only, not a backup and not a recovery service
- Rebuilding a zone stores the existing zone first (and aborts if it cannot), takes a double confirmation, and is verified per DC afterward — again for review only
- Every session is written to a log file automatically — on screen as it happens and appended to
%ProgramData%\KWTechSolutions\ADDnsCleanup\logs\line by line, so the record survives a crash or closing the app. It stays on that machine; nothing is sent anywhere - What the scan lists is a starting point, not a verdict — the stale determination is advisory, you approve every removal, and the software is provided AS-IS (see the EULA and
LICENSE.txt)
Published by KW Tech Solutions LLC · digitally signed · EULA shown on launch