if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Error "Exécutez ce script en tant qu'administrateur."
    exit 1
}

Import-Module DnsServer -ErrorAction Stop

$zoneName    = 'entreprisexyz.local'
$aName       = 'srv-dc1'
$aIP         = '192.168.147.10'
$forwarders  = @('8.8.8.8','8.8.4.4')

if (-not (Get-DnsServerZone -Name $zoneName -ErrorAction SilentlyContinue)) {
    Add-DnsServerPrimaryZone -Name $zoneName -ZoneFile "$zoneName.dns" -DynamicUpdate None -ErrorAction Stop
    Write-Host "Zone primaire '$zoneName' créée."
} else {
    Write-Host "Zone '$zoneName' existe déjà."
}

if (-not (Get-DnsServerResourceRecord -ZoneName $zoneName -Name $aName -RRType 'A' -ErrorAction SilentlyContinue)) {
    Add-DnsServerResourceRecordA -Name $aName -ZoneName $zoneName -IPv4Address $aIP -TimeToLive ([TimeSpan]::FromHours(1)) -ErrorAction Stop
    Write-Host "Enregistrement A ajouté : $aName.$zoneName -> $aIP"
} else {
    Write-Host "Enregistrement A $aName.$zoneName existe déjà."
}

try {
    Set-DnsServerForwarder -IPAddress $forwarders -ErrorAction Stop
    Write-Host "Redirecteurs DNS configurés : $($forwarders -join ', ')"
} catch {
    Write-Warning "Échec configuration redirecteurs : $_"
}