| external help file | DSInternals.PowerShell.dll-Help.xml |
|---|---|
| Module Name | DSInternals |
| online version | https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIDnsServerSigningKey.md |
| schema | 2.0.0 |
Retrieves DNSSEC signing key descriptors from Active Directory through LDAP.
Get-ADSIDnsServerSigningKey [-ZoneName <String>] [-Server <String>] [-Credential <PSCredential>]
[<CommonParameters>]
This cmdlet retrieves the DNSSEC zone signing key (ZSK) and key signing key (KSK) descriptors hosted in Active Directory by querying the target domain controller through LDAP. Only the key metadata is returned; use the Export-ADSIDnsServerSigningKey cmdlet to export the private key material.
PS C:\> Get-ADSIDnsServerSigningKey -Server 'lon-dc1.contoso.com' -ZoneName 'contoso.com'
<# Sample Output:
ZoneName : contoso.com
KeyId : 2e8c3148-04b3-462d-ae45-d87fe631fcee
KeyType : ZoneSigningKey
CryptoAlgorithm : RsaSha256
KeyLength : 1024
CurrentState : Active
ZoneSignatureValidityPeriod : 10.00:00:00
DnsKeySignatureValidityPeriod : 7.00:00:00
DSSignatureValidityPeriod : 7.00:00:00
IsRolloverEnabled : True
RolloverType : PrePublish
RolloverPeriod : 90.00:00:00
InitialRolloverOffset : 00:00:00
CurrentRolloverStatus : NotRolling
NextRolloverAction : Normal
LastRolloverTime : 3/28/2026 12:35:27 AM
NextRolloverTime : 8/15/2026 9:21:46 AM
NextKeyGenerationTime : 5/17/2026 9:21:46 AM
KeyStorageProvider : Microsoft Software Key Storage Provider
StoreKeysInAD : True
ActiveKey : 1c3737ea-f9a4-4902-b6a1-debc6227e627
ActiveKeyScope : Default
NextKey : 0b2ec560-1db7-41aa-98c6-8bdacc8727e5
NextKeyScope : AddOnly
StandbyKey :
StandbyKeyScope : Default
ZoneName : contoso.com
KeyId : e6eb8329-330c-4dd3-9989-2827434cb3d5
KeyType : KeySigningKey
CryptoAlgorithm : EcDsaP256Sha256
KeyLength : 256
CurrentState : Active
ZoneSignatureValidityPeriod : 10.00:00:00
DnsKeySignatureValidityPeriod : 7.00:00:00
DSSignatureValidityPeriod : 7.00:00:00
IsRolloverEnabled : True
RolloverType : DoubleSignature
RolloverPeriod : 755.00:00:00
InitialRolloverOffset : 00:00:00
CurrentRolloverStatus : NotRolling
NextRolloverAction : Normal
LastRolloverTime :
NextRolloverTime : 6/10/2028 9:21:46 AM
NextKeyGenerationTime :
KeyStorageProvider : Microsoft Software Key Storage Provider
StoreKeysInAD : True
ActiveKey : f91d2384-895d-45a2-adf9-f037624a107f
ActiveKeyScope : Default
NextKey :
NextKeyScope : Default
StandbyKey : ddf94e7e-0ed8-4bbb-9447-03fe66202874
StandbyKeyScope : AddOnly
#>Retrieves the DNSSEC signing key descriptors for the contoso.com zone from the specified domain controller through LDAP. The zone is protected by a zone signing key (ZSK) and a key signing key (KSK).
PS C:\> Get-ADSIDnsServerSigningKey -Server 'lon-dc1.contoso.com' | Format-Table
<# Sample Output:
ZoneName KeyType Algorithm KeyLength State RolloverType
-------- ------- --------- --------- ----- ------------
contoso.com ZoneSigningKey RsaSha256 1024 Active PrePublish
contoso.com KeySigningKey EcDsaP256Sha256 256 Active DoubleSignature
#>Displays a condensed table of all DNSSEC signing keys from the specified domain controller.
Specifies a user account to use when connecting to the target domain controller. The default is the current user.
Type: PSCredential
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSpecifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required.
Type: String
Parameter Sets: (All)
Aliases: Host, DomainController, DC, ComputerName
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseRestricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN).
Type: String
Parameter Sets: (All)
Aliases: Zone, DnsZone
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Export-ADSIDnsServerSigningKey Get-ADDBDnsServerSigningKey Get-ADSIDnsServerZone