netbios name translation problem


forsome reason i have netbios problem and computer seeing incorrect IP to the server name,
the wins server also have the bad record.

let's say that servername=, for some reason when pinging to the netbios name i receving (ping to FQDN is fine) , computer doesnt set to use WIN'S , however the server also have 2 records of the computername = (the wronge ip), i deleting the record but they keep coming back.

when i ping to to try to troubleshot the problem and find the computer or whaever it is i get no reply.

how do i troubleshot  this problem?

Who is Participating?

Improve company productivity with a Business Account.Sign Up

ymg800Connect With a Mentor Author Commented:
well finnaly find the problematic computer...

it's appear someone created VM with that name and that IP... stupid stupid stupid... :)
IS this over vlans?
Check you DNS server and remove the entries.

On the Client run ipconfig /displaydns and check the entries

then run ipconfig /flushdns and test
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

ymg800Author Commented:
dns only have the right record...

when it will happend again i will try to use ipconfig /displaydns to see if it's telling me something usfull

ipconfig /flushdns solving the problem but i sure it's not a DNS problem since FQDN is fine and i also have the bad record in the WINS server....
You shouldn't be using WINS if you have DNS on your network.

Is there a reason why you have both?
ymg800Author Commented:
wins reduce broadcasts when trying to find compuer by nebiose name...
u can access computer with UPN (\\servername) without wins?(not sure about that?)
also if old app trying to access single lable name...
and ... if some computer didnt registered in the dns server then i have backup...

please tell me with of my statment are correct and which isnt....
Microsoft is trying to Phase out WINS
You only require it if you have applications that still use NetBIOS to function

Have a look at this:

I disabled it on my network and have a pure DNS lookup, now I migrated from an old NT WINS domain to a new AD domain and done away with WINS
ymg800Author Commented:
yes but global names had problems...(so i heard)

i know ms trying to get rid of it but it doent saying that this day has come

can u access computer with single lable name without wins , link the ups : " \\SERVERNAME"
Yes of course, the domain prefix only comes into effect when you are moving from the LAN to a WAN
ymg800Author Commented:
dont make sence...

u only need it when u moving from LAN
if u are in a LAN the domain prefix is added automaticlly as per as your domain name
there can be mulitype dns zones so the prefix is valid...
Don't confuse or try to integrate WINS with DNS... They are separate entities.

WINS should only be used to resolve Netbios names across a WAN. It's because netbios is not routable, and held to the broadcast domain. A WINS server will accept the netbios broadcast for its local LAN, and then replicate that database with outer WINS partners on the WAN...

The ONLY corelation between WINS and DNS is if a master browser server can not resolve a netibos name, then DNS can look for another netbios server...

If you do NOT have a faulty DNS record, then it would appear that your computer has an ALTERNATIVE IP address or a second nic that isn't registering within DNS.

Can you provide an IPconfig /all of this computer that has a bad record..

If IPconfig flushDNS resolves the issue, then we have a different problem of a compter that has the same name as your server on the network. IP of .178 would probably be a Dynamic IP address. So, do you have that IP allocated to a computer in the network?

One thing you can do as a network admin is go to explorer and as a URL type:

//$   and look at the admin shares where is the incorrect IP.

Another handy tool to get more information is to go to the server and type:
Browstat /status
To make sure your browser is a unique name.
ymg800Author Commented:

let me put it in points:

1. do u say that WINS doesnt reduce the broadcast in a LAN? far as i understand client use the wins server in unicast mode to resolve netbiose name can DNS serach for another WINS server? where is the option for that? is that automatic?

3.there is no another IP or server or another NIC, only single IP also run ipconfig /all to confirm

4.well here is a new thing , while the record for wins for app-metro (server name) is not shown in WINS  anymore i now see that i have some DHCP for the 178 to the app-metro!!
but there is no ping to the IP and ping to the name app-metro gives me the right ip (12), well how can i trace that PC if it's exist??

5.when tring to access \\\c$, no reply

6. i tried goint to the server and type Browstat /status but it's saying the command is not recodnized??

thank a head!

Sorry for the late reply:

I am bringing up a new domain.

1) Netbios broadcast are spit out by the client to populate a WINS server, If no WINS server exists, there is a WINS caching server, (called a domain master browser), that collects the information. Typically the domain master browser is the PDCe. So, no a WINS server really doesn't reduce netbios broadcasts.


3) OK, is there a VPN connection. Those can also be considered and extra Netbios binding.
Multiple bindings can be a physical nic or virtual connection, when it comes to netbios.

4) It appears you may have created a manual IP address on app-metro, not a dynamic IP?? DHCP  updates are performed by the client. When the client releases the IP, the lease isn't immediately deleted from the DHCP database. It's held, (by default), for 4 hours called a reprieval time. Then once an hour, the DHCP server comes through and eliminates those leases so they can be used by other clients. It's my guess, you see the lease during this 4 hour period. If not, you have a machine that was once called app-metro that has a different mac address, and it was DISABLED in ADUC. Disabling a PC in ADUC will retain the lease in DHCP and not allow the DHCP server to clean up that lease. Leases are reserved by MAC addresses. So, look in ADUC to see if you have a computer called app-metro disabled.

I found this out myself during this problematic period:

5) that leads into a disabled computer in ADUC, as in my thread above.

6)Browstat is a part of the 2003 server admin pack. Do you have DCdiag on that computer?
ymg800Author Commented:
1. ok undertood

2.sorry but it cant see how it is related, where is the option it's mentioned how the DNS find another WINS in diffrent segment? also i didnt understood how can DNS help to resolve nebios name? do they mean that when netbouse name cant be resoved then it simply using DNS by adding the suffix? vpn

4. i dont have computer named   app-metro disabled... DHCP still showing app-metro = 10.x..x.178
by the way the server is using static DHCP so i cant understand why it's there...and no other name for app-metro there or record for the real address.

another thing, the name app-metro is not listed with the FQDN name but only the namebiose name while almost all other records listed with FQDN in the DHCP.

5.cant disbale as only the vailid on is there
6.Browstat /status svailble on the DC and the master browser is the DC which is the PDC

ymg800Author Commented:
that is the solution
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.