TechnitiumSoftware/DnsServer · critical · DnsWebServiceException

Failed to find 'DNS Administrators' group: auth.config file

Error message

Failed to find 'DNS Administrators' group: auth.config file is probably corrupt.

What it means

Sibling to the Administrators check: thrown in InspectAndFixZonePermissions when _authManager.GetGroup(Group.DNS_ADMINISTRATORS) returns null. The DNS Administrators built-in group is required so the server can grant ViewModifyDelete on every zone to DNS admins. Missing it means auth.config is corrupt.

Source

Thrown at DnsServerCore/DnsWebService.cs:460

            //remove ghost permissions
            foreach (KeyValuePair<string, Permission> subItemPermission in subItemPermissions)
            {
                string zoneName = subItemPermission.Key;

                if (_dnsServer.AuthZoneManager.GetAuthZoneInfo(zoneName) is null)
                    permission.RemoveAllSubItemPermissions(zoneName); //no such zone exists; remove permissions
            }

            //add missing admin permissions
            IReadOnlyList<AuthZoneInfo> zones = _dnsServer.AuthZoneManager.GetAllZones();
            Group admins = _authManager.GetGroup(Group.ADMINISTRATORS);
            if (admins is null)
                throw new DnsWebServiceException("Failed to find 'Administrators' group: auth.config file is probably corrupt.");

            Group dnsAdmins = _authManager.GetGroup(Group.DNS_ADMINISTRATORS);
            if (dnsAdmins is null)
                throw new DnsWebServiceException("Failed to find 'DNS Administrators' group: auth.config file is probably corrupt.");

            foreach (AuthZoneInfo zone in zones)
            {
                _authManager.SetPermission(PermissionSection.Zones, zone.Name, admins, PermissionFlag.ViewModifyDelete);
                _authManager.SetPermission(PermissionSection.Zones, zone.Name, dnsAdmins, PermissionFlag.ViewModifyDelete);
            }

            _authManager.SaveConfigFile();
        }

        private void ReadConfigFrom(Stream s)
        {
            if (Encoding.ASCII.GetString(s.ReadExactly(2)) != "WC") //format
                throw new InvalidDataException("Web Service config file format is invalid.");

            BinaryReader bR = new BinaryReader(s);

            int version = bR.ReadByte();

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Restore auth.config from a backup that retains both built-in groups.
2. Delete auth.config and restart the service to regenerate default groups, then reconfigure.
3. Recreate the 'DNS Administrators' group via the auth API before permissions reconciliation runs.

Example fix

null

if (_authManager.GetGroup(Group.DNS_ADMINISTRATORS) is null)
{
    // restore defaults or recreate the group
}

null

try { _dnsWebService.Start(); }
catch (DnsWebServiceException ex) when (ex.Message.Contains("DNS Administrators"))
{
    // restore auth.config / regenerate defaults
}

When it happens

Trigger: InspectAndFixZonePermissions runs and the built-in 'DNS Administrators' group is absent from auth.config.

Common situations: Same as Administrators: restored/edited/truncated auth.config, version mismatch, interrupted write, partial migration.

Related errors

• Failed to read 'Zones' permissions: auth.config file is prob
• Failed to find 'Administrators' group: auth.config file is p
• Web Service config file format is invalid.
• Web Service config version not supported.
• Invalid token or session expired.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/6f8e9bc8d9c34970. Report an issue: GitHub.