I was looking at the DNS zones for a project I’m working on. I needed to discover the conditional forwarder zone and hence the IP address of the DNS server to which the forwarding was occurring.
The zone I wanted had a ZoneType of 4 which puzzled me.
I remembered showing code to create a conditional forwarder in PowerShell in Practice (www.manning.com/siddaway)
$ip = “192.168.40.1”
$zone = [WMIClass]”\\dc02\root\MicrosoftDNS:MicrosoftDNS_Zone”
$zone.Create(“conditional.com”, 3, $true, $null, $ip)
When creating a conditional forwarder you use 3 for the zone type but when reading the zone you get a 4 as the zone type. Other zone types have similar differences
Primary zone (forward or reverse lookup) = create as type 0 and read as type 1
Stub zone = create as type 2 and read as type 3
This is another of the oddities that make WMI so much fun to work with. Easy when you know what’s happening but confusing when you don’t – just like so much with WMI. Does the W stand for Weird? 
The Windows Server 2012 DNS cmdlets make this sooooo much easier.