10.0.0.3 address on 192.168.1.x network

Is this machine taking its IP from a DHCP server?

Have you created these workstations' operating systems using a cloning package like ghost?  In which case have set the SID right?

Snibborg

Thank you for your speedy responses.  DHCP is enabled.  And we have cloned workstations in the past and given them new SID's.  I don't think this was one of them.

Run ipconfig /all and check if its taking ip address frmo correct DCHP server.

So it is supposed to have a 192.168.1.x address, the 10.0.0.3 isn't statically assigned on the server is it?  Is 10.0.0.3 a different subnet you use elsewhere?

No.  It's showing that DHCP is 10.0.0.1.  And it should say 192.168.1.1.  But  it's also contradicting itself as to whether DHCP is enabled.

Sounds like a rogue DHCP server on the network..
Where did this PC come from?

What you can do is take the MAC address of the problem machine in focus and make a reservation for it over dhcp server.

This shall force the MAC address to take particular ip address which would be of your subnet.

I'm going to try Aj8787's recommendation.  It'll take about an hour because my dinner just arrived and I'm famished.  Thank you all so much for your responses.  I'll let you know shortly how the 'reservation over the DHCP server' works out.

taking lrmoore's comment

check your internet router and wireless router to see if they are DHCP enabled.  You have something somewhere giving out DHCP addresses.

the reason why you other workstations aren't affected is as follows.  when a client gets a DHCP address, it will try and renew the same address 50% into the lease duration.  it will ask the issuing host if it can still use the same IP address - if the answer is yes, it will never send out a DHCP request broadcast which is why this problem has never come up before.  you can confirm this by stopping DHCP on your server and get one of your clients to get a new IP address - if it comes up 10.0.0.x then you know what the problem is.

good luck!

There is for sure a Rouge DHCP Server running.  Have you tried to swap Network Ports, pick a working port with a 192.168.x.x IP.  This way you can confirm 2 things, Either the PC is no working properly or if the the port is a member of a VLAN or part of a different network.

That way you can always avoid that port on the switch until you can get some time in finding that Rouge DHCP server.

OK.  When I looked for the DHCP server, it's address is the same as the Default Gateway, our Sonic Wall router so we must be enabled through the router.  I also looked on my DNS server under Admin Tools and the DHCP has not been authorized on that server.  Should I try to log into my Sonic Wall (which someone else set up and I know little about).  It would seem that authorizing it on my DNS server would create a conflict.

check the sonic wall to see if it has DHCP enabled as it will either confirm the problem, or rule out the sonicwall

It would  appear that since the default gateway is 192.168.1.1 and that IP address does not show up in my DNS console, it must be that the DHCP is enabled through the SonicWall router.  I visited their website with my log-on and they do have some info regarding DHCP configuration.

It seems that our SonicWall support agreement is still in effect so perhaps I should call them because I'm at a loss.  I'm still listening to all comments though, and will let you know what I find.

Have them check if the DHCP service is working on the SonicWall.  (which most likely is the case).  THen have them turn it off.  

Only thing you have to consider is why was it turned on in the first place.

What I will suggest is configure the unauthorized DHCP server over your DNS server same as your sonic wall DHCP (if thats the DHCP thats providing correct addreses) and then turn off sonic wall DHCP and authorize the DNS DHCP server

But then most probably you will have to run ipconfig /release /renew on every workstations or else they will pick up new DHCP server after their reboot....

try to rectify the sonic wall router DHCP point more so may be we can find easier way around.

OK.  Jakethecatuk was right!  I put the default gateway 10.0.0.6 into the browser.  It took me to a Netgear Wireless G Rouyter Page, Model GR614v10 which also told me that "...to avoid conflict router IP had been updated...Update IP addresses in Router configuration settings for each relevant service...etc."

So obviously, some of my "less-than-brilliant" users are trying to connect something wirelessly without my authorization.  I'll find out who it is on Monday and get rid of it.  Or perhaps I can just uninstall the Netgear object right now and things will fall back into place!?!

go and rip it off the desk and put it in your desk

they will try and find it on Monday and will come looking :)

once it's out of the way, everything will go back to normal.

>users are trying to connect something wirelessly without my authorization.
Good find, as in "rogue DHCP server" as I suspected...

OK.  Thank you all so very much for your thoughtful and timely responses to my dilemma.  I'll let you know what happens on Monday and will give the majority of the points to jakethecatuk for telling me exactly how to find the 'rogue DHCP,' and some to lrmoore for suggesting that that might be the problem in the first place.

I love this service!

The rogue is gone and all is well!  Thank you so much!