dhcp leases and master browser?

fimchick · March 15th, 2006

ok, we had a very odd problem today...all of a sudden, no dhcp leases were being handed out by either of our domain controllers. a static ip would work fine, but any requests for new dynamic ip's were just not going through. stopped and restarted dhcp service on both dc's, still no dice. then i noticed that event viewer contained multiple entries (over a period of months) where a user's laptop was announcing itself as a 'master browser'. as soon as i asked that user to shut down, dhcp was back up and leasing ip's.

as far as i understand, the browser service (and servers) are for locating resources on the network. so, if the laptop won the election for domain browser and was acting as a domain browser, would that be a cause for dhcp failures?

thanks!

**madmatt** · March 15th, 2006

In AD are you trusting that notebook for delegation?

fimchick · March 15th, 2006

no, i'm not...

**kcnychief** · March 15th, 2006

Looks like the registry needs to be modified on that laptop, modify these values:

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Services\Browser\Parameters
Name: IsDomainMaster
Data Type: REG_SZ
Value: FALSE

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Services\Browser\Parameters
Name: MaintainServerList
Data Type: REG_SZ
Value: Auto

that is what they SHOULD be set to, so it plays nicely on the network

EDIT: Do NOT Disable the local computer browser service, that will stop the problem but will also cause communication issues between the laptop and other machines on the LAN

**Steevo** · March 15th, 2006

Also accessable through X-Setup Pro.

Good job KCNYBRONCOS........

fimchick · March 15th, 2006

Thanks, already checked that earlier

As obvious as this may sound -- I was looking in the wrong direction the whole time. The IP addresses being doled out to clients were 192.168.x.x not APIPA. Sounds to me like someone ran a DHCP server on the network. Is there any way to track who did this with my two DC's?

**kcnychief** · March 15th, 2006

You can try to ping 192.168.1.1, if it's still out there, do a "arp -a" on the address. That should give you the MAC, which you can probably then track down.

If it's already off the network though, might be out of luck.

**fitz** · March 16th, 2006

Yeah.. it sounded to me like there was a rouge DHCP server out there.

If they already turned it off, it will be harder to track down.

fimchick · March 16th, 2006

Thanks for all the replies ladies and gentlemen!

**kcnychief** · March 16th, 2006

Just out of curiosity - were you able to track it down or was it gone?

March 15th, 2006	Top \| #1
fimchick OSNN Senior Addict Joined: March 2004 Location: Somewhere Posts: 276 Reputation: 220 Power: 104	dhcp leases and master browser? ok, we had a very odd problem today...all of a sudden, no dhcp leases were being handed out by either of our domain controllers. a static ip would work fine, but any requests for new dynamic ip's were just not going through. stopped and restarted dhcp service on both dc's, still no dice. then i noticed that event viewer contained multiple entries (over a period of months) where a user's laptop was announcing itself as a 'master browser'. as soon as i asked that user to shut down, dhcp was back up and leasing ip's. as far as i understand, the browser service (and servers) are for locating resources on the network. so, if the laptop won the election for domain browser and was acting as a domain browser, would that be a cause for dhcp failures? thanks! The problem with doing nothing all day, is that you never really know when you're done. Athlon 64 3200+ Asus A8V Deluxe 2gb Corsair ValueSelect Dual Channel DDR 3200 Ati x800XL 256mb Hdd #1 (SATA 100gb) Hdd #2 (ATA 80gb) Check out http://www.resistometer.com

March 15th, 2006	Top \| #2
madmatt Bow Down to the King Joined: April 2002 Location: New York Posts: 13,312 Reputation: 4090 Power: 297	Re: dhcp leases and master browser? In AD are you trusting that notebook for delegation?

March 15th, 2006	Top \| #3
fimchick OSNN Senior Addict Joined: March 2004 Location: Somewhere Posts: 276 Reputation: 220 Power: 104	Re: dhcp leases and master browser? no, i'm not... The problem with doing nothing all day, is that you never really know when you're done. Athlon 64 3200+ Asus A8V Deluxe 2gb Corsair ValueSelect Dual Channel DDR 3200 Ati x800XL 256mb Hdd #1 (SATA 100gb) Hdd #2 (ATA 80gb) Check out http://www.resistometer.com

March 15th, 2006	Top \| #4
kcnychief █▄█ ▀█▄ █ Joined: April 2005 Location: Massachusetts Posts: 16,949 Reputation: 4941 Power: 305	Re: dhcp leases and master browser? Looks like the registry needs to be modified on that laptop, modify these values: Hive: HKEY_LOCAL_MACHINE Key: System\CurrentControlSet\Services\Browser\Parameters Name: IsDomainMaster Data Type: REG_SZ Value: FALSE Hive: HKEY_LOCAL_MACHINE Key: System\CurrentControlSet\Services\Browser\Parameters Name: MaintainServerList Data Type: REG_SZ Value: Auto that is what they SHOULD be set to, so it plays nicely on the network EDIT: Do NOT Disable the local computer browser service, that will stop the problem but will also cause communication issues between the laptop and other machines on the LAN XBOX Live Gamertag: kcnychief

March 15th, 2006	Top \| #5
Steevo Spammer representing. Joined: September 2004 Posts: 2,566 Blog Entries: 2 Reputation: 1630 Power: 136	Re: dhcp leases and master browser? Also accessable through X-Setup Pro. Good job KCNYBRONCOS........ Meow. Equal oppertunity hater.

Latest News Posts

Latest Forum Posts

Latest Member Blogs

March 15th, 2006	Top \| #6
fimchick OSNN Senior Addict Joined: March 2004 Location: Somewhere Posts: 276 Reputation: 220 Power: 104	Re: dhcp leases and master browser? Thanks, already checked that earlier As obvious as this may sound -- I was looking in the wrong direction the whole time. The IP addresses being doled out to clients were 192.168.x.x not APIPA. Sounds to me like someone ran a DHCP server on the network. Is there any way to track who did this with my two DC's? The problem with doing nothing all day, is that you never really know when you're done. Athlon 64 3200+ Asus A8V Deluxe 2gb Corsair ValueSelect Dual Channel DDR 3200 Ati x800XL 256mb Hdd #1 (SATA 100gb) Hdd #2 (ATA 80gb) Check out http://www.resistometer.com

March 15th, 2006	Top \| #7
kcnychief █▄█ ▀█▄ █ Joined: April 2005 Location: Massachusetts Posts: 16,949 Reputation: 4941 Power: 305	Re: dhcp leases and master browser? You can try to ping 192.168.1.1, if it's still out there, do a "arp -a" on the address. That should give you the MAC, which you can probably then track down. If it's already off the network though, might be out of luck. XBOX Live Gamertag: kcnychief

March 16th, 2006	Top \| #8
fitz *XPista7eopardix Joined: April 2004 Location: Chicagoland Posts: 4,028 Reputation: 2947 Power: 168**	Re: dhcp leases and master browser? Yeah.. it sounded to me like there was a rouge DHCP server out there. If they already turned it off, it will be harder to track down. Hee-hee! Evil makes my buttocks tingle.

March 16th, 2006	Top \| #9
fimchick OSNN Senior Addict Joined: March 2004 Location: Somewhere Posts: 276 Reputation: 220 Power: 104	Re: dhcp leases and master browser? Thanks for all the replies ladies and gentlemen! The problem with doing nothing all day, is that you never really know when you're done. Athlon 64 3200+ Asus A8V Deluxe 2gb Corsair ValueSelect Dual Channel DDR 3200 Ati x800XL 256mb Hdd #1 (SATA 100gb) Hdd #2 (ATA 80gb) Check out http://www.resistometer.com

March 16th, 2006	Top \| #10
kcnychief █▄█ ▀█▄ █ Joined: April 2005 Location: Massachusetts Posts: 16,949 Reputation: 4941 Power: 305	Re: dhcp leases and master browser? Just out of curiosity - were you able to track it down or was it gone? XBOX Live Gamertag: kcnychief

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Is there a webpage that acts like a browser within a browser?	lancer	Windows Desktop Systems	14	June 16th, 2005 8:58am
DHCP server for wxp	kanbeki	Windows Desktop Systems	4	November 3rd, 2003 11:24am
DHCP Leases	hammerc	Windows Desktop Systems	3	August 28th, 2002 2:19am
DHCP Server?	AaronMcarthur	Windows Desktop Systems	4	July 6th, 2002 11:40pm
XP as DHCP server?	jeflies	Windows Desktop Systems	1	January 11th, 2002 3:29pm