DNSAdmins ServerLevelPluginDll Abuse

A Windows DNS Server feature-abuse path: a principal with write access to DNS server configuration (commonly DnsAdmins or equivalent MicrosoftDNS permissions) and DNS RPC access can configure the ServerLevelPluginDll property to reference a custom plugin DLL. The DNS server uses that plugin while resolving names outside locally hosted zones and loads it in the DNS service process. Code therefore runs with that service's token; on a Domain Controller running DNS as LocalSystem, impact can reach SYSTEM and domain-level privileges. The ability to trigger a service restart or internal DNS reload is a separate, environment-dependent permission. A referenced file must be a valid DNS plugin and readable by the service identity; an unreachable or invalid plugin can prevent DNS from starting. This is DNS plugin configuration abuse, not DLL search-order hijacking.