Windows 2003 DHCP server stopped by user NT AUTHORITY\SYSTEM

I run two DHCP servers on the same subnet. First is running on a Windows 2003 R2 Enterprise and also domain controller and second is running on a Windows 2003 Datacenter x64. In maximum 2-3 days and at random moments the DHCP server running on second W2003 server is stopped by user NT AUTHORITY\SYSTEM.
Which is the problem? how can it be solved?
audiconAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

g000seCommented:
Hello,

Are both DHCP servers issuing ip addresses for two different subnets?  For example-

DHCP server1 192.168.10.35 to 192.168.10.155

DHCP server2 192.168.20.12 to 192.168.20.233
0
Amit BhatnagarTechnology Consultant - SecurityCommented:
Hi,
Can you please some more information like the Scopes they are handling?
Any event IDs under the System Eveng log related to DHCP?
Is this from beginning or has it recently started happening etc?

This would really help us answer the question quickly.
0
audiconAuthor Commented:
Both DHCP servers are configured for the same IP range: 192.168.10.30 ... 192.168.10.250 with an exclusion interval 192.168.10.100 ... 192.168.10.200. There are also few reservations based on MAC address which are also identically defined.
The problem arise from the tirst time when the second DHCP server has been installed.

There are two related system log entries:

Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7035
Date:            3/17/2010
Time:            3:40:52 AM
User:            NT AUTHORITY\SYSTEM
Computer:      SERVER03
Description:
The DHCP Server service was successfully sent a stop control.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            3/17/2010
Time:            3:40:53 AM
User:            N/A
Computer:      SERVER03
Description:
The DHCP Server service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

g000seCommented:
Are both DHCP servers on the same subnet?  if so, I would just stick with one DHCP server per subnet.
0
audiconAuthor Commented:
@g000se: same subnet; with only one server there is no redundancy; also,is important not to have 2 separate ranges.
0
g000seCommented:
You can have separate ranges within the same IP address scope on one dhcp server.  I am curious to why there is a second dhcp server setup to issue same IP address subnet when you can define it on the first dhcp server.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
audiconAuthor Commented:
@g000se: It is important to obtain the same IP for all client machines, from either servers.
0
Amit BhatnagarTechnology Consultant - SecurityCommented:
Behaviour seems to be similar to rogue detection. also, this is not the proper way for high availability if thats what you are lookin for. you need to configure them according to the 80/20 rule. You can NOT have two active leases for the same IP range. create exclusion in each DHCP server which is opposite of each other. For e.g. 192.168.1.100  to 192.168.1.150 exclusion in 1st DHCP and create the same range for IP assignment in second DHCP server. Reverse it on the other for a different range.
0
audiconAuthor Commented:
Yes, we are looking for high availability. It is expensive to run DHCP server on cluster server so we prefer to have two independent DHCP servers with the same configuration. While using a single DHCP server every computer keep its address along the time with extremely rare cases. When start computer is looking for a DHCP server and it first claim its last used address. Usually the server did not allocate this address to any other host and then this address is available so the computer can keep its IP address.

The situation will change if we will use the 80/20 rule. Let see the scenarios:
The computer boot and then broadcasting for DHCP. Server1 will answer first and the computer will get an IP address from server1 - IP1. Then it shutdown. At next restart it broadcast again for DHCP and server2 will answer first. The computer will claim its last used IP address, IP1. Server2 cannot allocate IP1 (it is not in its range) so the computer will get IP2. Next shutdown, next boot. Suppose that now Server1 is answering. The computer will claim IP2 which Server1 cannot allocate. It can allocate IP1 but it also may allocate IP3.
So in the best case the computer will use IP1 or IP2. In the worst case it will use change the IP at every boot.

But if the two servers has the same configuration, every time the computer claim its last used IP the server (any of them) will be able to supply the same IP. The computer will end keeping its IP.
This work but at random time the second DHCP server is stopped by NT AUTHORITY\SYSTEM user. Then we lose the redundancy
0
Amit BhatnagarTechnology Consultant - SecurityCommented:
Have you gone through this article yet? A good article for anyone who is looking for High Availability without using clustering. As for this issue, the event ids are quite generic (Service Start\Stop message). Can you please confirm if there are any other Event IDs other than the ones, you are already seeing?

DHCP Best Practices
http://technet.microsoft.com/en-us/library/cc780311(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc739076(WS.10).aspx
0
audiconAuthor Commented:
I know both of the two Microsoft articles. The only thing I did not followed was the 80/20 rules, and this is because this 80/20 rule will give different IP address to a client. With two identically defined scopes the client can keep its IP address regardless of the server who is servicing its request.

0
audiconAuthor Commented:
The problem is due to running an old version of Tapeware backup on Windows 2003 Server. While saving System State the DHCP server was stopped and no longer restarted. After excluding system state from backup, the DHCP server no longer stops.
The question can be closed.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DHCP

From novice to tech pro — start learning today.