Windows Server 2008 stealing DHCP leases?

Hi,

I have a simple network in my office with routing instead of NAT, so my office is all covered with public IP addresses, which I have 16 available from my ISP. This configuration is working fine for few years now and is also quite fine protected with Cisco routers.
But it's not the problem here.

The problem arises from my lazines, because I was tired of manually setting IP properties for each machine I brought into office for repair. So I setup my Cisco to serve as DHCP for internal "LAN". DHCP was properly configured and allowed to deliver 2 IP addresses from public range.

Even this would in principle NOT be a problem, unless...
...unless my main Windows 2008 Server would not begin stealing DHCP leases.

I do not understand HOW, but a fect is, that Cisco shows 2 DHCP leases, both delivered to MAC address of my Windows 2008 NIC, but if I type ipconfig /all, I do not see these IP's designated to this particular NIC. See here:
------------------
On my router:
------------------
DHCP ClientsHost Name IP Address MAC Address Client Lease Time
VIPER5        xxx.212.81.27         00:15:17:6F:5E:08        0 days       02:00:00  
*                 xxx.212.81.28         00:15:17:6F:5E:08        0 days        02:00:00

------------------------------------------
On my Windows Server (VIPER5):
------------------------------------------
Ethernet adapter LAN Browse:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Server Adapter
   Physical Address. . . . . . . . . : 00-15-17-6F-5E-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d816:e214:bb96:91a5%17(Preferred)
   IPv4 Address. . . . . . . . . . . : xxx.212.81.24(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . : xxx.212.81.17
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
   NetBIOS over Tcpip. . . . . . . . : Enabled

If I delete these DHCP leases, server requests them both and Cisco delivers IP's back to it in few seconds.
I do not understand - which mechanism on Windows Server 2008 acts like this? DHCP is dicabled on all NIC adapters and actually it was never ever even enabled, because all IP's in my office are static and have never been on DHCP.
If I remember correct, this configuration was working some time ago, which means, that my Windows 2008 box did not behave like this all the time.

Any idea how to stop this DHCP client?
LVL 18
Andrej PirmanAsked:
Who is Participating?
 
debuggerauCommented:
Ah yes, the remote access server, certainly this could be configured to use DHCP addresses.

If you use the wizard to configure, this other option (a range of addresses) may be more appropriate.

RRAS.JPG
0
 
debuggerauCommented:
dual adaptors? Virtual Machines?
0
 
wantabe2Commented:
So you are saying you can set static IPs on the NIC & on the router you see new leases to the NIC with static IPs...
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Darius GhassemCommented:
Disable IPv6 on the nic
0
 
Andrej PirmanAuthor Commented:
Dual NICs?
Yes, I have 3 NIC's in my server, but only 1 with this particular MAC address, so other NIC's are irellevant in this case.

Virtual machines?
Nope, I disabled VM support in BIOS and also uninstalled Hyper-V role.

Yes, my NIC's all have STATIC IP's, and I see DHCP leases on my router. Thats strange.
Also:
- none of leased IP's respond to PING
- if I scan those DHCP leased IP's, nothing responds on any port
- If I pull off the cable from this particular NIC with this particular MAC address, then both DHCP leases dissapear. Which means, that NICs are actually sending out DHCP requests!
0
 
wantabe2Commented:
I think you may be seeing just the leases expiration time/date on the router since you can't ping them. That has to be it.
0
 
Andrej PirmanAuthor Commented:
Nope.
Unfortunatelly, there must be something else. DHCP leases re-appear few seconds after I delete them, so definitelly there is some DHCP request, not just lease expiration.

Also, I noticed something weird.
Let's name this NIC, which is stealing DHCP, NIC1.
If only NIC1 is connected, there are NO DHCP leases!
But as soon as I plug-in the second NIC2, at this moment NIC1 (yes, NIC1) imidiatelly receives 2 IP addresses via DHCP??!!
0
 
Darius GhassemCommented:
Have you disabled IPv6?
0
 
Andrej PirmanAuthor Commented:
Nope, IPv6 is not disabled.
Let me try...

No, no difference. I disabled IPv6 on all NIC's, reset DHCP on router, but lease appears immidiatelly after I reset DHCP. I can only disable DHCP lease if I disconnect 2nd NIC adapter, like this:

**** START TESTING ****

NIC1 --------X

NIC2 --------X

 (no DHCP leases)



**** STEP 1 ****

NIC1 ----------> router

NIC2 --------X

 (no DHCP leases)



**** STEP 2 ****

NIC1 ----------> router

NIC2 ----------> router

 (NIC1 receives IP from router via router's DHCP)
0
 
debuggerauCommented:
have you checked the DHCP server for any reservations?
They apply at the MAC layer, so when that MAC is presented to the network, it allocates an IP...
0
 
Andrej PirmanAuthor Commented:
No, there are no reservations on DHCP on router.

I also double-checked if there are any other DHCP in my network, so I switched OFF all other machines, except my main server....but this server still receives DHCP from router.

I think the main problem is in Windows 2008 technology, actually, how it handles NIC cards.
0
 
debuggerauCommented:
what roles in the windows 2008 server running currently? DHCP server?


could you post a "ipconfig /all" results with the server completely disconnected?

0
 
Andrej PirmanAuthor Commented:
My 2008 server does NOT have DHCP role.
Only my router has DHCP to serve wireless clients.
Server has static IP on all interfaces.

If I alter DHCP rang on router, no matter what, server 2008 steals ALL IP's available, all leased to same server's MAC address 00:15:17:6F:5E:08

Here is ipconfig /all:
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.
 
C:\Users\Andrej>ipconfig /all
 
Windows IP Configuration
 
   Host Name . . . . . . . . . . . . : VIPER5
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : No
 
Ethernet adapter LAN Browse:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Server Adapter
   Physical Address. . . . . . . . . : 00-15-17-6F-5E-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : xxx.212.81.24(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . : xxx.212.81.17
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Ethernet adapter LAN DNS + Local:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) 82566DM-2 Gigabit Network Connec
tion #2
   Physical Address. . . . . . . . . : 00-19-99-42-EB-1E
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : xxx.212.81.20(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Tunnel adapter Local Area Connection* 8:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{D679307E-4426-4101-AF85-E8F999841
58D}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 9:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 02-00-54-55-4E-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 11:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{33F3A9FA-5B8D-4F81-8836-1E93644EA
926}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 12:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : 6TO4 Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2002:59d4:5114::59d4:5114(Preferred)
   IPv6 Address. . . . . . . . . . . : 2002:59d4:5118::59d4:5118(Preferred)
   Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Disabled

Open in new window

0
 
Andrej PirmanAuthor Commented:
Found out something:

It has definitelly something to do with RRAS service!
If I disable RRAS on my Windows 2008 server, DHCP leases disappear on router!
0
 
Andrej PirmanAuthor Commented:
Since sollution was actually found by me, only B grade.
0
 
Andrej PirmanAuthor Commented:
Or, in Windows 2008 case on already configured RRAS, this would be the correct setting to avoid using DHCP:
RRAS.jpg
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.