DCs sending to obsolete IP address

[Guest]

I have two Windows 2000 Domain Controllers (DCs) in an Active Directory
Forest. Several months ago, we changed our IP addressing scheme from
192.1.32.x to 172.25.x.x to include more host IP addresses. This process was
complete with only minor issues which were later resolved. However, when I do
a "netstat -n -p tcp" from the command prompt on either DC, I am getting a
SYN_SENT message from that DC destined for an address of 192.1.32.7--this
occurs on a regular basis. In addition, I am also seeing ISAKMP messages (UDP
port 500) originating from the DC to the same 192.1.32.7 address.
I have conducted a search for "192.1.32.7" in the entire Registry and came
up empty. The Active Directory was going to be the next place to do a search
for the IP address, but does Active Directory only stores the NetBIOS
computer name and not the IP address? If AD does keeps track of computers' IP
addresses, how do I go about searching the AD database for that IP address
and removing it (if that address is found to be in the AD database)? My hunch
that the AD DB might contain the IP address is because both DCs are
attempting to open a TCP connection, along with initiating the ISAKMP process
as well.
Any assistance would be greatly appreciated.

 

[Ryan Hanisco]

Kevin,

AD doesn't store IP addresses like that in itself but, rather, uses DNS as
its source. You will want to go through your DNS to make sure that the old
addresses have been removed there. You may need to flush your DNS cache and
purge any stale DNS records.