How to Enable DNS Query Logs in Windows DNS Server

Home > Windows > DNS > How to Enable DNS Query Logs in Windows DNS Server

How to Enable DNS Query Logs in Windows DNS Server

✅ Enable DNS Analytical Logging in Event Viewer

1. Press Win + R, type eventvwr, and press Enter.
2. In Event Viewer, go to View > Show Analytic and Debug Logs (makes Analytical logs visible).
3. Navigate to:
   

  Applications and Services Logs → 

  Microsoft → 

  Windows → 

  DNS-Server → 

  Analytical

1. Right-click Analytical → Properties → Check Enable Logging → Click OK.

✅ Enable DNS Debug Logging via DNS Manager

1. Press Win + R, type dnsmgmt.msc, and press Enter.
2. Right-click your DNS server (e.g., SERVER-NAME) → Properties → Debug Logging tab.
3. Enable Log packets for debugging and select:
   

  ✓ Queries

  ✓ Updates

  ✓ Notifications

  ✓ Other DNS messages

1. Click Apply → OK.

📁 Log File Location

• Analytical logs (ETL format):
  

 C:\Windows\System32\winevt\Logs\Microsoft-Windows-DNS-Server%4Analytical.etl

🔄 Convert .etl to .csv via PowerShell

1. Navigate to the log directory in PowerShell.
2. Run:
   

 tracerpt "Microsoft-Windows-DNS-Server%4Analytical.etl" -o DNS_Logs.csv -of CSV

⚠️ Important Notes

• Debug logs consume significant disk space—monitor regularly.
• Analytical logs require no DNS zone configuration.
• For long-term logging, schedule log rotation/archiving.

Home > Windows > DNS > How to Enable DNS Query Logs in Windows DNS Server