• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 351
  • Last Modified:

Clients picking up old DNS servers intermitantly

Every now and then various PC's in the domain are showing the old DNS server addresses. Why could this be and how can I solve it?

thanks
Craig
0
BerryGardens
Asked:
BerryGardens
  • 14
  • 10
1 Solution
 
Chris DentPowerShell DeveloperCommented:

Do they get their IP addresses from a DHCP server?

When they end up with the wrong addresses are they using the right DHCP server? You can see the DHCP server used in "ipconfig /all".

Chris
0
 
BerryGardensAuthor Commented:
They do yes, We have two DHCP servers which are configured for this ans I have checked all the settings.

The problem PC's show the old DNS server.  A reboot sorts it but why is this happening I wonder? I've checked all the devices, i.e. Wireless are not reporting incorrectly.
0
 
Chris DentPowerShell DeveloperCommented:

It is possible to configure DNS servers using Group Policy, it may be worth checking for something like that, and potentially checking for any scripts that may modify the current servers.

Chris
0
 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

 
BerryGardensAuthor Commented:
Good idea. I have checked and found nothing though. Only have default domain policy (quite simple) and logon script for printers/DFS shares.
0
 
Chris DentPowerShell DeveloperCommented:

If one has the wrong value, does running "ipconfig /renew" give it the correct server list?

Chris
0
 
BerryGardensAuthor Commented:
yes
0
 
BerryGardensAuthor Commented:
Any other ideas, its happen this morning to a few clients??
0
 
Chris DentPowerShell DeveloperCommented:

Search the registry for the old entries?

Does it happen for newly built PCs? Are there any common factors with the PCs experiencing this?

Chris
0
 
BerryGardensAuthor Commented:
No common factors, its a mix of new PC's and old sorry. I have even re-installed a machine and it still does it. Searching the reg now
0
 
Chris DentPowerShell DeveloperCommented:

If it's doing it for new PCs I think we have three sources:

1. Rogue DHCP
2. Old Policy
3. Old Script

If you have the means, seeing if it reproduces on a client that isn't a member of the domain would be useful, that would point towards 1. However, I'd expect to see that in the "DHCP Server" listed in "ipconfig /all", which makes the other two more likely.

Chris
0
 
BerryGardensAuthor Commented:
I found some stamps for the old servers in the following location:

HKLM\system\currentcontrolset\services\parameters\dhcp server name

will monitor until the morning and see if this sorts the problem. you are the front runner for the points nice one. really appreciate the help
0
 
BerryGardensAuthor Commented:
sorry left out \tcpip\
HKLM\system\currentcontrolset\services\tcpip\parameters\dhcp server name
0
 
Chris DentPowerShell DeveloperCommented:

Near enough :)

It's odd that it appears there. The server in question is really down isn't it?

Chris
0
 
BerryGardensAuthor Commented:
I did see the correct DHCP server when this problem appears its just the DNS servers which were wrong. This to me means the DHCP server was giving out the incorrect DNS address but I have checked everything related to DNS on that server and it looks fine.

What your saying makes sense but I can't find the scripts or policies with references to the old servers.
0
 
BerryGardensAuthor Commented:
No its not down the same server is in production, its been demoted as DC and DNS and provides updates for the Anti-virus (sophos).
0
 
Chris DentPowerShell DeveloperCommented:

Ahh okay, fair enough :)

If the DHCP server is listed as the other then it can hardly be giving out addresses for clients. I just wondered that was all.

Chris
0
 
BerryGardensAuthor Commented:
Yeah I agree, I didn't think to look through the registry tho (backing up before of course :) - its nice just to have that extra input to give me another direction to investigate, really appreciate you looking in on this will report back soon

Craig
0
 
Chris DentPowerShell DeveloperCommented:

Hmmm if you can try with a client which isn't part of the domain? That might incriminate the DHCP service itself which perhaps would be useful.

Chris
0
 
BerryGardensAuthor Commented:
I'm connecting via a non-domain laptop at the moment and the problem does not appear. I will power cycling it a few times to see and will let you know, cheers :)
0
 
BerryGardensAuthor Commented:
power cycling - new sport :) ! sorry mis typed
0
 
BerryGardensAuthor Commented:
No change its still happening to the same people. out of ideas on this one!
0
 
Chris DentPowerShell DeveloperCommented:

Nothing in the Registry now?

Packet Sniffer and capture the address details given out by DHCP?

Chris
0
 
BerryGardensAuthor Commented:
Which software would you use to sniff?
0
 
Chris DentPowerShell DeveloperCommented:

Wireshark (www.wireshark.org), it's one of the best free packet sniffers around. I find it considerably easier to use than Network Monitor which seems like it got left behind with Windows NT.

Chris
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 14
  • 10
Tackle projects and never again get stuck behind a technical roadblock.
Join Now