{"record":{"id":"ad556bb026118758","repo":"TechnitiumSoftware/DnsServer","slug":"failed-to-find-administrators-group-auth-config","errorCode":null,"errorMessage":"Failed to find 'Administrators' group: auth.config file is probably corrupt.","messagePattern":"Failed to find 'Administrators' group: auth\\.config file is probably corrupt\\.","errorType":"exception","errorClass":"DnsWebServiceException","httpStatus":null,"severity":"critical","filePath":"DnsServerCore/DnsWebService.cs","lineNumber":456,"sourceCode":"            if (permission is null)\n                throw new DnsWebServiceException(\"Failed to read 'Zones' permissions: auth.config file is probably corrupt.\");\n\n            IReadOnlyDictionary<string, Permission> subItemPermissions = permission.SubItemPermissions;\n\n            //remove ghost permissions\n            foreach (KeyValuePair<string, Permission> subItemPermission in subItemPermissions)\n            {\n                string zoneName = subItemPermission.Key;\n\n                if (_dnsServer.AuthZoneManager.GetAuthZoneInfo(zoneName) is null)\n                    permission.RemoveAllSubItemPermissions(zoneName); //no such zone exists; remove permissions\n            }\n\n            //add missing admin permissions\n            IReadOnlyList<AuthZoneInfo> zones = _dnsServer.AuthZoneManager.GetAllZones();\n            Group admins = _authManager.GetGroup(Group.ADMINISTRATORS);\n            if (admins is null)\n                throw new DnsWebServiceException(\"Failed to find 'Administrators' group: auth.config file is probably corrupt.\");\n\n            Group dnsAdmins = _authManager.GetGroup(Group.DNS_ADMINISTRATORS);\n            if (dnsAdmins is null)\n                throw new DnsWebServiceException(\"Failed to find 'DNS Administrators' group: auth.config file is probably corrupt.\");\n\n            foreach (AuthZoneInfo zone in zones)\n            {\n                _authManager.SetPermission(PermissionSection.Zones, zone.Name, admins, PermissionFlag.ViewModifyDelete);\n                _authManager.SetPermission(PermissionSection.Zones, zone.Name, dnsAdmins, PermissionFlag.ViewModifyDelete);\n            }\n\n            _authManager.SaveConfigFile();\n        }\n\n        private void ReadConfigFrom(Stream s)\n        {\n            if (Encoding.ASCII.GetString(s.ReadExactly(2)) != \"WC\") //format\n                throw new InvalidDataException(\"Web Service config file format is invalid.\");","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/DnsWebService.cs#L438-L474","documentation":"Thrown in InspectAndFixZonePermissions when _authManager.GetGroup(Group.ADMINISTRATORS) returns null. The Administrators group is a built-in account that must always exist; its absence indicates auth.config is corrupt or was hand-edited. The routine cannot grant the mandatory ViewModifyDelete permission to admins for every zone without the group handle.","triggerScenarios":"InspectAndFixZonePermissions runs (startup or after zone/config changes) and the built-in 'Administrators' group is missing from auth.config.","commonSituations":"auth.config restored from a foreign/broken source, manual JSON/binary edit that removed built-in groups, partial migration, or a config write that was interrupted and left groups list empty.","solutions":["Restore auth.config from backup that contains the built-in Administrators group.","Delete auth.config and restart the service to regenerate default built-in groups, then reapply custom users.","Use the Web Service auth API to recreate the Administrators group before the next permissions reconciliation."],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"if (_authManager.GetGroup(Group.ADMINISTRATORS) is null || _authManager.GetGroup(Group.DNS_ADMINISTRATORS) is null)\n{\n    // auth.config is missing built-in groups; restore defaults\n}","typeGuard":"null","tryCatchPattern":"try { _dnsWebService.Start(); }\ncatch (DnsWebServiceException ex) when (ex.Message.Contains(\"Administrators\"))\n{\n    // restore auth.config or delete it to regenerate defaults\n}","preventionTips":["Back up auth.config before user/group changes.","Do not delete built-in groups when restructuring auth.","Validate auth.config integrity (signature + required groups) after restores."],"tags":["dns-server","technitium","auth","configuration","config-corruption","permissions","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}