• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1223
  • Last Modified:

Windows 2003 DHCP server stopped by user NT AUTHORITY\SYSTEM

I run two DHCP servers on the same subnet. First is running on a Windows 2003 R2 Enterprise and also domain controller and second is running on a Windows 2003 Datacenter x64. In maximum 2-3 days and at random moments the DHCP server running on second W2003 server is stopped by user NT AUTHORITY\SYSTEM.
Which is the problem? how can it be solved?
0
audicon
Asked:
audicon
  • 6
  • 3
  • 3
2 Solutions
 
g000seCommented:
Hello,

Are both DHCP servers issuing ip addresses for two different subnets?  For example-

DHCP server1 192.168.10.35 to 192.168.10.155

DHCP server2 192.168.20.12 to 192.168.20.233
0
 
Amit BhatnagarTechnology Consultant - SecurityCommented:
Hi,
Can you please some more information like the Scopes they are handling?
Any event IDs under the System Eveng log related to DHCP?
Is this from beginning or has it recently started happening etc?

This would really help us answer the question quickly.
0
 
audiconAuthor Commented:
Both DHCP servers are configured for the same IP range: 192.168.10.30 ... 192.168.10.250 with an exclusion interval 192.168.10.100 ... 192.168.10.200. There are also few reservations based on MAC address which are also identically defined.
The problem arise from the tirst time when the second DHCP server has been installed.

There are two related system log entries:

Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7035
Date:            3/17/2010
Time:            3:40:52 AM
User:            NT AUTHORITY\SYSTEM
Computer:      SERVER03
Description:
The DHCP Server service was successfully sent a stop control.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            3/17/2010
Time:            3:40:53 AM
User:            N/A
Computer:      SERVER03
Description:
The DHCP Server service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

 
g000seCommented:
Are both DHCP servers on the same subnet?  if so, I would just stick with one DHCP server per subnet.
0
 
audiconAuthor Commented:
@g000se: same subnet; with only one server there is no redundancy; also,is important not to have 2 separate ranges.
0
 
g000seCommented:
You can have separate ranges within the same IP address scope on one dhcp server.  I am curious to why there is a second dhcp server setup to issue same IP address subnet when you can define it on the first dhcp server.

0
 
audiconAuthor Commented:
@g000se: It is important to obtain the same IP for all client machines, from either servers.
0
 
Amit BhatnagarTechnology Consultant - SecurityCommented:
Behaviour seems to be similar to rogue detection. also, this is not the proper way for high availability if thats what you are lookin for. you need to configure them according to the 80/20 rule. You can NOT have two active leases for the same IP range. create exclusion in each DHCP server which is opposite of each other. For e.g. 192.168.1.100  to 192.168.1.150 exclusion in 1st DHCP and create the same range for IP assignment in second DHCP server. Reverse it on the other for a different range.
0
 
audiconAuthor Commented:
Yes, we are looking for high availability. It is expensive to run DHCP server on cluster server so we prefer to have two independent DHCP servers with the same configuration. While using a single DHCP server every computer keep its address along the time with extremely rare cases. When start computer is looking for a DHCP server and it first claim its last used address. Usually the server did not allocate this address to any other host and then this address is available so the computer can keep its IP address.

The situation will change if we will use the 80/20 rule. Let see the scenarios:
The computer boot and then broadcasting for DHCP. Server1 will answer first and the computer will get an IP address from server1 - IP1. Then it shutdown. At next restart it broadcast again for DHCP and server2 will answer first. The computer will claim its last used IP address, IP1. Server2 cannot allocate IP1 (it is not in its range) so the computer will get IP2. Next shutdown, next boot. Suppose that now Server1 is answering. The computer will claim IP2 which Server1 cannot allocate. It can allocate IP1 but it also may allocate IP3.
So in the best case the computer will use IP1 or IP2. In the worst case it will use change the IP at every boot.

But if the two servers has the same configuration, every time the computer claim its last used IP the server (any of them) will be able to supply the same IP. The computer will end keeping its IP.
This work but at random time the second DHCP server is stopped by NT AUTHORITY\SYSTEM user. Then we lose the redundancy
0
 
Amit BhatnagarTechnology Consultant - SecurityCommented:
Have you gone through this article yet? A good article for anyone who is looking for High Availability without using clustering. As for this issue, the event ids are quite generic (Service Start\Stop message). Can you please confirm if there are any other Event IDs other than the ones, you are already seeing?

DHCP Best Practices
http://technet.microsoft.com/en-us/library/cc780311(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc739076(WS.10).aspx
0
 
audiconAuthor Commented:
I know both of the two Microsoft articles. The only thing I did not followed was the 80/20 rules, and this is because this 80/20 rule will give different IP address to a client. With two identically defined scopes the client can keep its IP address regardless of the server who is servicing its request.

0
 
audiconAuthor Commented:
The problem is due to running an old version of Tapeware backup on Windows 2003 Server. While saving System State the DHCP server was stopped and no longer restarted. After excluding system state from backup, the DHCP server no longer stops.
The question can be closed.
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

  • 6
  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now