Unable to add root trust anchor

[catsem]

Trying to setup DNSSEC validation on a Server 2016 DNS Server I'm facing strange issues when trying to add the root trust point.

PS C:\Users\foo> Add-DnsServerTrustAnchor -Root
Add-DnsServerTrustAnchor : Failed to create the root trust anchors on server WDC1.
At line:1 char:1
+ Add-DnsServerTrustAnchor -Root
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotImplemented: (foo:root/Microsoft/...rverTrustAnchor) [Add-DnsServerTrustAnchor], Cim
Exception
+ FullyQualifiedErrorId : WIN32 9603,Add-DnsServerTrustAnchor

##############################################################################

PS C:\Users\foo> dnscmd /RetrieveRootTrustAnchors
Are you sure you want to Retrieve and add root trust anchors (activating DNSSEC validation)? (y/n) y

Command failed: DNS_ERROR_INVALID_ZONE_OPERATION 9603 0x2583

##############################################################################

And I don't even have the "Trust Point" entry in DNS Manager MMC snap-in.

Any ideas?

Best Chris

Continue reading...