| Hostname | IP Address | Status | Assigned To | Last Scan | Actions |
|---|---|---|---|---|---|
| MONT-DC-003 | 164.231.187.34 | 2026-01-14 | |||
Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServerDNS_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 61E8A883CEBE6190A40D2710E426BE2D03B1A4D8 ~~~~~ EnableVersionQuery: 0 Comments |
|||||
Check Text
The "EnableVersionQuery" property controls what version information the DNS server will respond with when a DNS query with class set to "CHAOS" and type set to "TXT" is received. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Open a command window and execute the command: nslookup <enter> Note: Confirm the Default Server is the DNS server on which the command is being run. At the nslookup prompt, type: set type=TXT <enter> set class=CHAOS <enter> version.bind <enter> If the response returns something similar to text = "Microsoft DNS 6.1.7601 (1DB14556)", this is a finding.
Fix Text
To disable the version being returned in queries, execute the following command: dnscmd /config /EnableVersionQuery 0 <enter>