[

KINGWERX

]
← IT TOOLS

AD DNS CLEANUP

Remove stale _msdcs DNS records left behind by a demoted or failed Domain Controller

$75
ONE-TIME PURCHASE · PER TECHNICIAN
COMING SOON
🔒 Launching soon · secure checkout via Lemon Squeezy at release
  • Signed Windows installer
  • Unique license key
  • Instant email delivery
  • Free updates
  • Runs on DC or RSAT workstation
  • Email support

When a Domain Controller is demoted or fails permanently, it leaves orphaned records in the _msdcs zone — GUID CNAME aliases, Kerberos/LDAP SRV records, and delegation NS records that point to a DC that no longer exists. Those stragglers quietly break your environment: dcdiag DNS Delegation failures, "missing glue A record" errors, KCC replication topology errors, and wasted DNS lookups on every client. AD DNS Cleanup finds them and lets you remove them safely, in one session.

FEATURES

DNS HEALTH TEST

Runs dcdiag /test:DNS /v and parses every sub-test — Authentication, Delegations, Records, Forwarders — into a color-coded PASS/FAIL report. 10-minute safety timeout.

STALE RECORD SCAN

Walks every CNAME, SRV, and NS record in the _msdcs zone and flags the orphans — targets with no A record that are not a live DC. Results in a pre-checked multi-select list.

REBUILD _MSDCS

Forces every live DC to re-register its DNS records right now (nltest /dsregdns) — locally and on remote DCs over WinRM. The same safe operation Netlogon runs at boot.

SAFE PREVIEW & CLEANUP

A read-only Preview shows exactly what would be removed before anything happens. REMOVE requires confirmation, logs every operation PASS/FAIL, and re-scans automatically when done.

REQUIREMENTS

  • Run as Domain Admin or Enterprise Admin (elevated / UAC)
  • ActiveDirectory and DnsServer PowerShell modules
  • Best run directly on a healthy DC, or a workstation with full RSAT installed
  • WinRM enabled on remote DCs for the Rebuild _msdcs feature

SUPPORTED WINDOWS

  • Fully tested: Windows Server 2016, 2019, 2022, 2025
  • Supported (caveats): Server 2012 / 2012 R2 with WMF 5.1 installed
  • Workstation: Windows 10 (1809+) / 11 with AD & DNS RSAT tools

BUILT TO BE SAFE

  • Preview is read-only — REMOVE always requires an explicit confirmation
  • Pre-flight compares against live DCs and parent-zone A records before flagging anything stale
  • Only the _msdcs zone is touched — never AD computer objects, Sites & Services, or other DNS zones
  • Every operation is logged, and the tool re-scans after each cleanup

Published by KW Tech Solutions LLC · digitally signed · EULA shown on launch

$75
ONE-TIME PURCHASE · PER TECHNICIAN
COMING SOON
🔒 Launching soon · secure checkout via Lemon Squeezy at release