I was reviewing the configuration of my Microsoft DNS server by executing
dnscmd localhost /exportsettings and then going through the
C:\Windows\system32\dns\DnsSettings.txt file. As I understood the
SecureSecondaries displays the the zonetransfer settings. If it is set to 0 (meaning "Disable secondary security. Send zone transfers to all secondary servers that request them."), it is a security risk as discussed here (it can reveal sensitive information about the network topology).
However in the
SecureSecondaries is set to
0 for the
[Zones] Cache=Cache,AD-integrated *removed* [Cache] Type=Cache Store=AD-integrated AllowUpdate=0 ZoneDN=DC=RootDNSServers,cn=MicrosoftDNS,DC=*removed* DirectoryPartition=*removed* SecureSecondaries=0 Secondaries=NULL NotifyList=NULL
However I can not find where it can be disabled in the DNS Manager application, and the command given by Microsoft:
dnscmd localhost /ZoneResetSecondaries Cache /NoXfr returns
Command failed: DNS_ERROR_ZONE_DOES_NOT_EXIST 9601 0x2581.
Is DNS zone transfer really enabled for the Cache zone, or as Cache is not a master zone it can not be enabled at all? If it is enabled, how can I disable it?