TTL value for A and PTR records
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
Path in the GPO console
Computer Configuration\Administrative Templates\Network\DNS Client Description
Specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by the DNS client to which this policy setting is applied. To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes). If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by the DNS client. If you disable this policy setting, or if you do not configure this policy setting, the DNS client will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes).
Registry
HKLM
Software\Policies\Microsoft\Windows NT\DNSClient MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_DnsClient/DNS_RegistrationTtl Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: TTL value for A and PTR records
; State: Enabled
; Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient]
"RegistrationTtl"=dword:00000258More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RegistrationTtl' -Value 600 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_DnsClient/DNS_RegistrationTtl
Data type: String
Value:
<enabled/>
<data id="DNS_RegistrationTtlLabel" value="600"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'RegistrationTtl' -Expected 600 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RegistrationTtl' -Value 600 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'RegistrationTtl' -Expected 600 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: TTL value for A and PTR records
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RegistrationTtl' -Value 600 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.