?
Solved

DNS value automatically changing on XP system

Posted on 2008-11-12
14
Medium Priority
?
299 Views
Last Modified: 2012-05-05
We have a few computers that run DHCP from our DC and most of the time they run fine, but every so often we will get a call that they cannot access the internet. I do an ipconfig /all and the DNS Server values have changed to an IP address that doesn't exist on our network. Also noticed that, at least on one occasion that DNS Suffix Search List removed one of ours and replaced it with mshome.net. If we reboot the machines they are back to working normally. I also didn't notice anything running on one of the machines that would tip me off to the cause.
0
Comment
Question by:judsoncollege
  • 5
  • 4
  • 4
13 Comments
 
LVL 39

Expert Comment

by:ChiefIT
ID: 22938687
This is a DHCP scope option. You will find the rogue DNS server under DHCP snapin>>options.

prefered DNS server configurations are passed down to DHCP clients from the DHCP server.
0
 
LVL 16

Accepted Solution

by:
cantoris earned 2000 total points
ID: 22939290
Does one of your subnets have a PC running on it that is acting as a rogue DHCP Server?  ie Has someone enabled Internet Connection Sharing on their LAN Interface?  When such a PC is on it could be handing out 192.168.0.z IP addresses to PCs on that network segment when they boot.

Or here's another possibility: Server 2003's NAT's DHCP Allocator has become activated.  See below article for a clear description, screenshots and solution.
http://msmvps.com/blogs/bradley/archive/2004/04/24/5452.aspx
0
 

Author Comment

by:judsoncollege
ID: 22940638
We have 20+ DHCP scopes and the scope for this vlan is fine. If we reboot these machines they pickup everything correctly. It's just at some point their network settings provided by DHCP change, but only a couple. The rest stay the same. There was an addional field that changed I didn't notice. So... while they are working and everyhting is fine their DNS server values go from 2 valid IP addresses to a single one that doens't exist. Also mshome.net is added to the "DNS Suffix Search List" and mshome.net has become the value in "Connection-spcific DNS Suffix". It supposidly changes without them doing anything out of the norm. One lady was telling me she was working in a Word document. The is happening on a single vlan and only to a few people out of about 20. It happens to the same people over and over, but may happen a few times a day or may happen every few days or so.

Also, RRAS is not runnign on any of our Domain Controllers or on the computers this is happening to. It is disabled on each.
0
NEW Veeam Backup for Microsoft Office 365 1.5

With Office 365, it’s your data and your responsibility to protect it. NEW Veeam Backup for Microsoft Office 365 eliminates the risk of losing access to your Office 365 data.

 
LVL 16

Expert Comment

by:cantoris
ID: 22941501
Sounds as though the VLAN in question has a rogue DHCP Server on it.  Next time it happens, go to the affected PC and use  ipconfig /all  to check the listed Default Gateway which I presume will have changed (if none is listed you should see the address of the rogue DHCP server listed).  Perhaps it'll be 192.168.0.1.  Give it a ping.  Then use
nbtstat -A <IP address>
to get the machine's hostname - that should help you work out what is going on.  If you cannot resolve the hostname, use
arp -a
to view the ARP cache and find the MAC of the device with that IP address.  Perhaps you can then find which port on your Network Switch sees a device with that MAC connected to it and thus trace it to a PC or just disable that switch port (as long as you know it's not a port to your DC or something!) and see who squeals!
0
 

Author Comment

by:judsoncollege
ID: 22942146
Thanks cantoris, but that is the weird thing. I would have expected the same thing, but the DHCP server listed is correct, the Gateway is also correct. Everything looks !00% correct except that the DNS server has changed from the 2 we have listed to just 1 that isn't even valid and the mshome.net entry for DNS Suffix.
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 22942358
Is your router supplying DHCP?
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 22942374
You might try DHCPloc.exe when this happens. It looks like you have  a rogue DHCP server.

OR, you could have multiple Network connections, one for home and the other for the LAN.
0
 

Author Comment

by:judsoncollege
ID: 22944804
DHCP is not supplying DHCP. We have a 2003 server doing that. I grabbed DCHPloc.exe, ran it, but don't see anything right now. It doesn't always happen so I can only guess that someone is turning something on and then off at random times. I will continue to test this and see if i can find anything.
0
 
LVL 16

Expert Comment

by:cantoris
ID: 22945176
Any DHCP-related events in the event log of your 2003 server that is holding the DHCP role?
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 22991467
judsoncollege:

We havn't heard from you on cantoris' question. How are things going?
0
 

Author Comment

by:judsoncollege
ID: 23158817
Sorry guys. I tried something and was waiting to see if it worked. We haven't had the problem for a few weeks so I think we figured it out. We never turned off Internet Connection Sharing company wide and it looks like that is what was causing the problem. I setup a Group Policy to turn it off on all company computers and it hasn't been a problem since. Thanks for all the responses.
0
 
LVL 16

Expert Comment

by:cantoris
ID: 23163331
ICS was the first thing I mentioned...   ;)
Glad you've apparently sorted it.
0
 

Author Comment

by:judsoncollege
ID: 23166697
Sorry cantoris, I totally missed that. Thanks for the help.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question