Link to home
Start Free TrialLog in
Avatar of mkramer777
mkramer777Flag for United States of America

asked on

dns server address changed

Windows 2012 server environment.  Windows 10 Pro client.  

Had a user that could not get on the internet so I went to command line and did ipconfig /all and noticed that the DNS server was 192.168.1.1  The settings for this computer were obtain ip and Dns auto.  I changed it to 8.8.8.8 and all is well.  I will change back to auto later and see what happens.  Any reason how this could have been changed when it was set to auto?  

NOTE: When I looked at ipv4 in the LAN properties both the ip address and DNS WERE set to auto.
Avatar of Amir Azhdari
Amir Azhdari
Flag of United States of America image

Check your DHCP, it should show green mark next to it, it could be all IP addresses in a scope have been allocated and DHCP is unable to assign IP address to the client (in this case DHCP shows a blue circle with exclamation mark)
Avatar of mkramer777

ASKER

This is for DNS obtain not client ip address obtain
DNS parameters can be obtained via DHCP, if DHCP if configured to do so.
On the client if a ipconfig /flushdns is performed follow by ipconfig /all, does the DNS address remain correct?
DHCP can be (and often is) configured to supply DNS server addresses to clients along with IP addresses. When a client is set to obtain its DNS configuration automatically, it will obtain it through DHCP as long as the DHCP server is configured to provide it.

In your case, it's possible that you have more than one device on your network acting as a DHCP server. Routers, for example, are often configured as DHCP servers by default.

ok so what is 192.168.1.1 pointing to?  Guessing the router.. I am also guessing that this is not a domain but a workgroup.
Not pointing to anything.  Can't get to it with a browser and can't ping it.  Router is a different ip.  All clients with issues (I found out there are 2 now) are in the domain.


maybe just a reboot of the DHCP server?


You can stop the dhcp, and then reboot one of the affected clients and see if they can get any IP address, if so, then it means there's alternate dhcp server in your network which makes a conflict.
Have you checked DHCP to see if any exclamation mark next to it or it's showing green?
I have the green check mark.  I made a mistake when I added this question.  It is windows 2008 R2.  

I thought of the alternate DHCP server on the network.  I have not added any servers or equipment for over 2 years.  How would even know if there is a rougue DHCP server out there?  I can't login or ping the ip that showed up.  


Can you please set the IP address and DNS to auto on the client. Open a command prompt  as administrator on the client and run ipconfig /all and paste the result here. Thanks.
It would be great if you can do the above on one of the clients that is not affected and works ok and share the results seperately so we can compare it.
I did this already.  The only difference was the DNS server.  These 2 machines have a different DNS server than all the others I have checked.  

NOTE:  I changed the DNS server on the problem machines to 8.8.8.8 and 4.2.2.2.  I guess I will set LAN settings to obtain auto from DHCP server and reboot and let DHCP had out an ip and then see if it happens again.

Yes set them to auto, and reboot server and the clients and let us know the results please.
This should be mentioned:

All clients with issues (I found out there are 2 now) are in the domain.

You can change their DNS server addresses temporarily for troubleshooting purposes, but all domain-joined clients should be using an internal DNS server rather than 8.8.8.8, 4.2.2.2, or any other public server.
Had something happen again on a new computer.  No new devices have been installed on network for 2 years.  A client computer was having issues like the ones described in the question so I set him with a static ip and everything worked fine so he could work the afternoon.  I decided to set pc back to automatic detect and then I did ipconfig /all and I received the info on the screenshot.  I rebooted and then I received the correct dhcp and dns info from the DHCP server.  I tried to ping 192.168.1.1 and nothing came up.  Opened a web browser and I got nothing.  I'm not sure what is going on.  The "Rougue" dhcp server handed out an ip address to this clent.


User generated image
1- replace the network cable with a brandnew one for the affected PC, leave the network on automatic detect and check if they get IP address, if not go to 2
2- Change the network port from the patch panel and connect it to a different port in thr switch and check the above again, if the issue persists go to 3
3- If your router has got WiFi connection then plug a WiFi adapter into one of the affected PC and connected it to the nework via WiFi and check it.
Please let us know the results.
ipconfig /all will show the DHCP servers IP address
which in your picture is 192.168.1.1h
which is also the dns and the gateway.. This could  be  the isp's modem. / router
you are going to have to find this device on your network.
arp -a will show you the ip address's and MAC addresses.
you can use a mac address lookup website to find the manufacturer of the dhcp server
i.e. https://dnschecker.org/mac-lookup.php?query=E0-63-DA-5A-80-37
which in my case is ubiquiti
I will be checking some of the things above from the last 2 comments.  I am leaving for a day or two in a bit.

Wanted to let you know of one more odd thing.  Another computer all of a sudden received and ip from a different DHCP server.  The 192.168.1.1 one that has been mentioned. Still can't find where it is or ping it. I ran a rogue DHCP software and it found nothing but the correct DHCP server.

Anyway,  I rebooted the computer and it received the correct ip address, dhcp, and dns server info.  Here is the odd thing:  I was connected to the computer with a remote control software and was looking at ipconfig /all info and noted the ip address as 192.0.0.233 for this machine.

A few seconds later my connection dropped and I connected back. (took another 5 seconds) When I entered ipconfig /all again the computer had received the ip of 192.0.0.149

I have never seen that happen before.  Is this a lease issue as well?

Statically assigned my laptop as 192.168.1.50 with default gateway as 192.168.1.1 and then ran Advanced IP scanner.  It found a Netgear Router (WGR614v10)

This is the wireless router that is in a remote site where we use Ubiquiti point to point wireless devices on top of the buildings.  I logged into the router and it had checked "use router as DHCP server" Unchecked!!!

OK.  Figured that out, now I need to ask this: The router has been in this location for the past 5 years and I have never had this issue.  I know that I should have initially unchecked "use router as dhcp server" but you live and learn.  Why at this time (2 weeks ago) did it start to hand out ip's to our network computers?  

The wireless point to point setup is this:  From the wirless access point on the roof of the small office a network cable is plugged into this router. Then from the router cables run to 2 laptops.   Same thing on our home office roof to HP switch.

Could someone have unplugged the cables (maybe to clean or for cable management) and plugged one of them into a port that would have activated the process of handing out ip addresses?
all it takes is for a hiccup on the primary dhcp server and it not to be found first. This was just something lying in wait
so as David Johnson mentioned earlier, there was a second dhcp in your network causing the issue. I have marked his comment as solution.
ASKER CERTIFIED SOLUTION
Avatar of mkramer777
mkramer777
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial