GPO – PowerShell – Intune – Add additional DNS Client Servers across the enterprise

16 Aug

Let’s say you have the entire Windows member server fleet of Windows Server 2016/2019/2022, Windows 11 Pro/Enterprise etc., using DNS Server 1 and Server 2 within their TCP-IP properties and now you decide to add DNS Server address 3 and Server 4 to the member servers to increase resiliency.

In the blog post, I will demonstrate how you can add the additional DNS Server using Group Policy Object and PowerShell with your enterprise.

What doesn’t work?

It would be best if you didn’t waste time – The GPO Computer Configuration –> Administrative Templates –> Network –> DNS Client –> DNS Servers doesn’t work. The “Supported On” version doesn’t include Windows Server 2016\Windows 10 in the compatibility. Even if you apply this GPO, it will apply to the server within the registry, but there will be no visible change under the TCP-IP properties.


We are going to implement this configuration via group policy object within the enterprise:

  • The necessary active directory permissions to create, apply and link the GPOs
  • Access to the Sysvol folder to store the script
  • WMI Filters to target the script\GPO to specific subnets (More details below)

PowerShell Script for DNSClient (Additional DNS Servers)

Save the below script and place it within the location – \\DOMAINNAME\SYSVOL\DOMAINNAME\scripts\SetDNSAddress.ps1″

  • Please enter the proper DNS Server Address within the script based on your environment and requirements.
$dnsclient=Get-DnsClient  | Get-DnsClientServerAddress | where{$_.ServerAddresses -contains "" -or $_.ServerAddresses -contains ""}
foreach($nic in $dnsclient){
Set-DnsClientServerAddress -InterfaceIndex $nic.InterfaceIndex -ServerAddresses ("","","","")

Create the GPO (Additional DNS Servers)

On a member server with administrative privileges, press Win + R to open the Run box. Type gpmc.msc and press Enter to open the Group Policy Management Console.

  • In the GPMC, expand the forest and domain trees on the left pane to locate the domain you want to create the GPO in.
  • Right-click on “Group Policy Objects” under the domain and select “New” to create a new GPO.
  • In the “New GPO” dialog box, provide a name for the GPO (e.g., “Additional DNS Servers”) and click “OK”.
  • Right-click on the newly created GPO and select “Edit” to open the Group Policy Management Editor.
  • Navigate to Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks
  • Right Click on Scheduled Tasks > Configure the task as Immediate Task.
  • Give it a name – SetDNSClient
  • Set the user account as SYSTEM. It will automatically convert into NT Authority\system.
  • Set the check “run with highest privileges”
  • In the Actions tab, create a new “Start a program” action.
  • Set the Program as: PowerShell.exe
  • Set the Add Arguments point to this line, and modify including your network share and file: ExecutionPolicy Bypass -command “& \\DOMAINNAME\SYSVOL\DOMAINNAME\scripts\SetDNSAddress.ps1”
  • Set the following in common Tab. – “Apply once and do not reapply”

Bonus Tip – WMI Filters

You want to target the GPO to a specific set of member servers who’s IP range starts with a particular IP address. Then you can create a WMI filter such as the below to target particular computers that meet the below range. In the below example, the GPO will apply to the machine starting with IP Address 10.XX OR 10.XX.

Select * FROM Win32_IP4RouteTable
WHERE (Mask=''
AND (Destination Like '192.168.%' OR Destination Like '192.169.%'))

Intune (Configuration Profiles – Doesn’t Work)

As of writing the blog post the Intune built-in setting\CSP is showing similar behaviour like the DNS Server GPO it doesn’t work.


Under both situations (CSP & ADMX templates), the report says the policy is applied successfully. However, there is no visible impact on the operating system’s TCP-IP properties. I am optimistic that using the Scripts method and PowerShell can achieve the same results in Intune. Please let me know in the comments sections if you got it working or/else if you would like to see a blog post on using Intune Scripts to set the DNS Client on member servers.

Following are the references and important links worth going through for more details:

Static DNS Servers via GPOUpdate DNS static servers in your local Network (
DNS Server GPO doesn’t workDNS Server GPO Settings Invisible in IPConfig – CB5 Solutions LLC (

I hope you will find this helpful information for applying additional DNS servers via the GPO and PoweShell. I want to thank my friend Eqbal Hussian for his assistance and additional rounds of testing\validations. Please let me know if I have missed any steps or details, and I will be happy to update the post.

Aresh Sarkari

One Response to “GPO – PowerShell – Intune – Add additional DNS Client Servers across the enterprise”


  1. Microsoft Intune – Add additional DNS Client Servers across the managed devices | AskAresh - August 24, 2023

    […] work and which don’t. If you’re interested, you can read more about it on – GPO – PowerShell – Intune – Add additional DNS Client Servers across the enterprise | AskAresh. As promised, here are the steps for performing the same task in Microsoft Intune for all of your […]

Leave a Reply

%d bloggers like this: