TechnitiumSoftware/DnsServer · critical · DnsWebServiceException

Failed to find 'Administrators' group: auth.config file is p

Error message

Failed to find 'Administrators' group: auth.config file is probably corrupt.

What it means

Thrown in InspectAndFixZonePermissions when _authManager.GetGroup(Group.ADMINISTRATORS) returns null. The Administrators group is a built-in account that must always exist; its absence indicates auth.config is corrupt or was hand-edited. The routine cannot grant the mandatory ViewModifyDelete permission to admins for every zone without the group handle.

Source

Thrown at DnsServerCore/DnsWebService.cs:456

            if (permission is null)
                throw new DnsWebServiceException("Failed to read 'Zones' permissions: auth.config file is probably corrupt.");

            IReadOnlyDictionary<string, Permission> subItemPermissions = permission.SubItemPermissions;

            //remove ghost permissions
            foreach (KeyValuePair<string, Permission> subItemPermission in subItemPermissions)
            {
                string zoneName = subItemPermission.Key;

                if (_dnsServer.AuthZoneManager.GetAuthZoneInfo(zoneName) is null)
                    permission.RemoveAllSubItemPermissions(zoneName); //no such zone exists; remove permissions
            }

            //add missing admin permissions
            IReadOnlyList<AuthZoneInfo> zones = _dnsServer.AuthZoneManager.GetAllZones();
            Group admins = _authManager.GetGroup(Group.ADMINISTRATORS);
            if (admins is null)
                throw new DnsWebServiceException("Failed to find 'Administrators' group: auth.config file is probably corrupt.");

            Group dnsAdmins = _authManager.GetGroup(Group.DNS_ADMINISTRATORS);
            if (dnsAdmins is null)
                throw new DnsWebServiceException("Failed to find 'DNS Administrators' group: auth.config file is probably corrupt.");

            foreach (AuthZoneInfo zone in zones)
            {
                _authManager.SetPermission(PermissionSection.Zones, zone.Name, admins, PermissionFlag.ViewModifyDelete);
                _authManager.SetPermission(PermissionSection.Zones, zone.Name, dnsAdmins, PermissionFlag.ViewModifyDelete);
            }

            _authManager.SaveConfigFile();
        }

        private void ReadConfigFrom(Stream s)
        {
            if (Encoding.ASCII.GetString(s.ReadExactly(2)) != "WC") //format
                throw new InvalidDataException("Web Service config file format is invalid.");

View on GitHub (pinned to d0484b6c1e)

Solutions

Restore auth.config from backup that contains the built-in Administrators group.
Delete auth.config and restart the service to regenerate default built-in groups, then reapply custom users.
Use the Web Service auth API to recreate the Administrators group before the next permissions reconciliation.

Example fix

null

Defensive patterns

Strategy: try-catch

Validate before calling

if (_authManager.GetGroup(Group.ADMINISTRATORS) is null || _authManager.GetGroup(Group.DNS_ADMINISTRATORS) is null)
{
    // auth.config is missing built-in groups; restore defaults
}

Type guard

null

Try / catch

try { _dnsWebService.Start(); }
catch (DnsWebServiceException ex) when (ex.Message.Contains("Administrators"))
{
    // restore auth.config or delete it to regenerate defaults
}

Prevention

Back up auth.config before user/group changes.
Do not delete built-in groups when restructuring auth.
Validate auth.config integrity (signature + required groups) after restores.

When it happens

Trigger: InspectAndFixZonePermissions runs (startup or after zone/config changes) and the built-in 'Administrators' group is missing from auth.config.

Common situations: auth.config restored from a foreign/broken source, manual JSON/binary edit that removed built-in groups, partial migration, or a config write that was interrupted and left groups list empty.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/ad556bb026118758. Report an issue: GitHub.