SBS 2003 server detects another SBS server and throws a paddy, but there isnt another SBS server on the network.
Does anyone know how it detects other SBS servers and how i can replicate it so I can locate the 'other SBS server' myself?
Details:
SBS 2003, SP2. Single NIC, All FMSO roles, DHCP, DNS.
192.168.1.x / 24 network behind a Netgear internet router.
Eventid 1011:
Multiple domain controllers running Windows Server 2003 for Small Business Server have been detected in your domain. To prevent this computer from shutting down in the future, you must remove all but one of these from the domain.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
After a bit of digging and testing I've worked it out.
It seems that the SBS checks any domains listed in it's DNS cache to see if it has any competition on the network.
This is quite clever as it means that if two systems reside on the same network and make even a single reference to each other it will be listed i the DNS cache and will be checked. On checking it will see ports open and be able to work out who the PDC is. If it's behind a router (eg on the internet) these ports will be closed and the server is happy it cannot see the other server.
In this case, some idiot had run Spybot on the server and had not been aware this adds a HUGE number of domains to the HOSTS file and points them all to 127.0.01.
While this is a basic way of stopping users/malware from accessing the sites, it also mean the server did it's usual checks on these domains listed in it's cache and ended up seeing itself, thinking it had competition and throwing a paddy..... (Proof that computers really are dumb...)
Deleted entries from hosts file and cleared cache and all is now fine. No other SBS boxes have been seen and the server is behaving itself again...Yey!