What are the minimum permissions needed to manage DNS Policies in Server 2016?

I'm implementing DNS Policies, writing PowerShell scripts for certain tasks, and of course I don't want to schedule these tasks as domain admins; I want to use a least-privileged service account.

The thing is, I can't seem to figure out what's needed, and where. AD includes the DnsAdmins group, but it's not enough.

DNS Policy Components

There are essentially 3 new elements to DNS Policies:

• Zone Scopes
• Client Subnets
• Policies

Zone Scopes are part of the zone itself, so on an AD-integrated zone, they are replicated with the zone.

But Client Subnets and Policies are not stored in AD, so they are not replicated and there's no directory partition for example, where you could check or set permissions.

Example Problem

Trying to create a Client Subnet entry, which works fine with a domain admin account, gives me a cryptic error about checking the internal exception details.

Doing that gives me a WIN32 1011 error:

The configuration registry key could not be opened.

Googling that error is fairly useless, and it never says which registry key it is.

This is with an account that is a normal domain user, but is a member of DnsAdmins and has no other special privileges.

That account can read a DNS Client Subnet just fine. But adding one fails.

For contrast, a domain user that is not a member of DnsAdmins, cannot read the client subnet entry (permission denied).

Code

# Read a Client Subnet
Get-DnsServerClientSubnet -cn MyDC -Name 'My_CS_Entry'

# Add a Client Subnet
Add-DnsServerClientSubnet -cn MyDC -Name 'My_CS_Entry'

So absent any documentation, I'm at a loss as to how to properly delegate permissions for this.