How to Configure Windows Server DNS Scavenging to Remove Stale Records

Introduction

In a dynamic Active Directory environment, computers constantly join and leave the network. By default, when a DHCP lease expires or a machine is decommissioned without proper un-joining procedures, its DNS A-record remains in the Windows Server DNS zone. Over time, these “stale” records accumulate, causing severe name resolution conflicts and authentication failures. DNS Scavenging is the built-in Microsoft solution that automatically deletes these outdated records. This guide explains how to properly configure DNS Scavenging to maintain a clean namespace.

Understanding the Scavenging Timers

Scavenging relies on three separate timers that you must understand to avoid accidentally deleting valid records:

• No-Refresh Interval: The period during which a DNS record cannot be refreshed (usually 7 days). This prevents unnecessary replication traffic across Domain Controllers for records that haven’t actually changed IP addresses.
• Refresh Interval: The period after the No-Refresh interval during which a record must be refreshed by the client (usually another 7 days).
• Scavenging Period: How often the DNS server actually runs the deletion process (e.g., every 7 days).

A record only becomes “stale” and eligible for deletion after both the No-Refresh and Refresh intervals have passed (e.g., 14 days total).

Step 1: Enable Scavenging on the DNS Server

Scavenging must be enabled at three different levels: the Server, the Zone, and the Record. First, we enable it on the Server.

1. Open the DNS Manager console (dnsmgmt.msc).
2. Right-click your DNS Server hostname and select Properties.
3. Navigate to the Advanced tab.
4. Check the box for Enable automatic scavenging of stale records.
5. Set the scavenging period. The default is 7 days, which is usually appropriate for most environments. Click Apply and OK.

Step 2: Enable Scavenging on the Forward Lookup Zone

Next, you must enable scavenging on the specific zone containing the dynamic records.

1. In DNS Manager, expand Forward Lookup Zones.
2. Right-click your primary Active Directory zone (e.g., yourdomain.local) and select Properties.
3. On the General tab, click the Aging button.
4. Check the box for Scavenge stale resource records.
5. Leave the No-refresh interval and Refresh interval at their defaults (7 days each) unless you have highly specific DHCP lease times that dictate otherwise.
6. Click OK to close the Aging properties, and OK again to close the Zone properties.

Step 3: Force Scavenging and Monitor

With scavenging enabled at both the Server and Zone levels, the automated process will run based on the period you set in Step 1. However, you can force it to run immediately to clear existing backlog.

1. Right-click your DNS Server hostname in the DNS Manager.
2. Select Scavenge Stale Resource Records.
3. A prompt will ask if you want to proceed. Click Yes.

To verify the process worked, open the Windows Event Viewer and navigate to Custom Views > Server Roles > DNS Server. Look for Event ID 2501 (Scavenging completed successfully) or Event ID 2502 (Scavenging completed but no records were deleted). If records were deleted, the event details will state exactly how many were removed.