dhcp leases and master browser?

fimchick

OSNN Senior Addict
Joined
14 Mar 2004
Messages
276
ok, we had a very odd problem today...all of a sudden, no dhcp leases were being handed out by either of our domain controllers. a static ip would work fine, but any requests for new dynamic ip's were just not going through. stopped and restarted dhcp service on both dc's, still no dice. then i noticed that event viewer contained multiple entries (over a period of months) where a user's laptop was announcing itself as a 'master browser'. as soon as i asked that user to shut down, dhcp was back up and leasing ip's.

as far as i understand, the browser service (and servers) are for locating resources on the network. so, if the laptop won the election for domain browser and was acting as a domain browser, would that be a cause for dhcp failures?

thanks!
 
In AD are you trusting that notebook for delegation?
 
Looks like the registry needs to be modified on that laptop, modify these values:

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Services\Browser\Parameters
Name: IsDomainMaster
Data Type: REG_SZ
Value: FALSE

Hive: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Services\Browser\Parameters
Name: MaintainServerList
Data Type: REG_SZ
Value: Auto

that is what they SHOULD be set to, so it plays nicely on the network :)

EDIT: Do NOT Disable the local computer browser service, that will stop the problem but will also cause communication issues between the laptop and other machines on the LAN
 
Also accessable through X-Setup Pro.


Good job KCNYBRONCOS........ :D
 
Thanks, already checked that earlier :)

As obvious as this may sound -- I was looking in the wrong direction the whole time. The IP addresses being doled out to clients were 192.168.x.x not APIPA. Sounds to me like someone ran a DHCP server on the network. Is there any way to track who did this with my two DC's?
 
You can try to ping 192.168.1.1, if it's still out there, do a "arp -a" on the address. That should give you the MAC, which you can probably then track down.

If it's already off the network though, might be out of luck.
 
Yeah.. it sounded to me like there was a rouge DHCP server out there.

If they already turned it off, it will be harder to track down.
 
Just out of curiosity - were you able to track it down or was it gone?
 

Members online

No members online now.

Latest profile posts

Also Hi EP and people. I found this place again while looking through a oooollllllldddd backup. I have filled over 10TB and was looking at my collection of antiques. Any bids on the 500Mhz Win 95 fix?
Any of the SP crew still out there?
Xie wrote on Electronic Punk's profile.
Impressed you have kept this alive this long EP! So many sites have come and gone. :(

Just did some crude math and I apparently joined almost 18yrs ago, how is that possible???
hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.

Forum statistics

Threads
62,015
Messages
673,494
Members
5,621
Latest member
naeemsafi
Back