Steps to enable DNS Query Logging on Windows systems

XINSTALL BY CLICKING THE DOWNLOAD FILE

To fix various PC problems, we recommend DriverFix:
This software will keep your drivers up and running, thus keeping you safe from common computer errors and hardware failure. Check all your drivers now in 3 easy steps:

Download DriverFix (verified download file).

Click Start Scan to find all problematic drivers.

Click Update Drivers to get new versions and avoid system malfunctionings.

DriverFix has been downloaded by 0 readers this month.

Microsoft released a new version of the Sysmon tool. The company confirmed that Windows system monitor now supports DNS query logging.

This tool is developed by the CTO of Microsoft Azure Mark Russinovich, who announced the new feature on his official Twitter account. Russinovich attached a screenshot showing how the tool logs DNS queries and information.

Sysmon with DNS query logging and original file name reporting will publish on Tuesday. pic.twitter.com/0nTKJahjSe

— Mark Russinovich (@markrussinovich) June 8, 2019

Let’s discuss how Sysmon works. It basically monitors specific events currently on the system and then maintains their record in the event log.

But from now onwards, the new Sysmon version brings DNS query logging support. Interestingly, you can also spot which query initiated the program by looking at the “Image” value.

How to enable DNS logging on Windows

Open the run dialogue box by hitting Windows+R keys.

Now type eventvwr.msc in the dialogue box and hit Enter. It will open the Event Viewer Window.

At this step, navigate to Applications and Service Logs >> Microsoft >> Windows >> DNS Client Events >> Operational.

You will see Operational option, right click on it and click Enable Log.

Finally, DNS logging is now enabled on your system.

Users are excited about this feature

Windows users are really excited about this new feature. Many users started commenting on the post about how the feature would be beneficial.

It looks like you get more data in one event with this vs the dns client log. If you are already using sysmon this is a big win. Don’t have to ask the windows team to turn on DNS client logs.

Another Windows user stated:

Yep so many times I had to fire up message analyzer to grab the process making the DNS request. Really exciting!

What do you think about DNS query logging feature in Windows system monitor? Let us know in the comments section below.