note if you are running this on vista or later, or based on the fact you are referring to DNSCMD then 2008 or later will all need to use elevation to execute the commands.
windows UAC on vista / 2008 or later OS will all run in low privilege sessions even if the account you specify is an administrative account.
The login process has been changed significantly on these operating systems. I would highly recommend Mark Russinovich's guide to UAC to explain what is happening here.
But the short version is this.
When logging in as an admin account on a UAC enabled system. You actually get two authentication tokens.
1) admin token
2) filtered token
the idea is to reduce rights for admin users so they don't accidentally run malicious content on a server. Therefore any time you attempt to do anything it is run in the filtered token context this simply means an account which has less or equal privilege to a standard user.
You can easily flick between the tokens using "right click runas admin".
Now obviously this is not so easy on a programmatic call. There are a couple of ways to achieve this. The simplest of which is to download a 3rd part tool called elevate.exe.
then run
elevate.exe dnscmd <blah blah>
the other ways are somewhat more complicated particularly in light of the fact WinRM is involved.
