DNS Servers Settings Suddenly Change

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I am having an issue with multiple Windows XP Pro Machines on a client’s
corporate network. All machines are set to obtain DNS Setting Automatically
(which they do) however periodically (twice a day) they will suddenly change
the IP address settings for their DNS servers. To be more correct they
change the address of the primary server and lose the secondary server DNS
setting altogether. This happens well after they have been assigned via DHCP
and the address it changes to is similar to the original. If I do an
ipconfig/release and renew they get the correct settings again, but will
change back in approximately 12 hours. The TTL on the DHCP server is 30 days
and they are defiantly getting their DHCP info from the correct server.

I have up to date AV (McAfee’s Virus Scan Enterprise) and have run a full
virus sweep with nothing found. I have ran Adaware/Spybot and MS’s spyware
utilities with nothing noteworthy to mention.

There are some entries in the event log that seem to correspond with the DNS
server change but I think they are a result of no longer talking with AD once
the DNS servers have been lost and not the cause of the issue. They are
Event ID 5719: Netlogon There are currently no Domain Controllers Available
and Event ID 7: Kerberos The Kerberos subsystem encountered a PAC
verification error.

I have checked GP to see if some policy setting could be assigning new DNS
servers but found nothing…Is there even a GP setting for DNS servers??? I
have also checked HKLM\software\policies\microsoft\windowsNT for some reg
setting that might set DNS but found nothing there either. (checked there in
reference to a google post)

Any help would be appreciated…..Thanks in advance.

Rob
 
Rob,

One reasonably simple explanation for this problem is that there are
two DHCP servers operating on the network. Your DC sets the IP
addresses (client, gateway, DNS) in the morning and then a second DHCP
server resets them later on in the day. The second DHCP server is
probably a router, adsl modem, wireless access point or similar device
that was set up as a DHCP with the same IP range (hence the similar
addresses).

To find the source of thte problem, either check the settings of all of
your devices, or change the IP range on the server (i.e. use
192.168.30.xxx instead of 192.168.20.xxx). When the IP addresses change
you'll know for sure what the source of the poblem is: if the address
is in the .20's there's a second DHCP, if it's in the 30's it's your
server. You could also run "IPconfig /all" (without the quotes) from a
DOS prompt after the addresses change and check the address of the DHCP
server (it's listed about halfway down). Actually, if possible run the
command above before and after the client PC's addresses change and
post here, will help dissect the problem.

Good luck!
Dusty
 
Thanks Dusty,

Unfortunately I don’t believe a rouge DHCP server is the issue here. I ran
an ipconfig/all and the DHCP server is remaining the same before and after
the issue….I even pulled the cable from the actual DHCP server during the
problem to see if some other device was using its IP and no other device
answered a ping or a DHCP request in its absence. Here are the results from
the IPConfig’s…

Before the issue…All is settings are correct and the machine is functioning
normal:

IP Address: 192.168.1.63
Subnet Mask 255.255.255.0
Default Gateway: 192.168.1.254
DHCP Server: 192.168.1.2
DNS Servers: 192.168.1.2
192.168.1.1
Primary WINS Server: 192.168.1.2

After the issue….Notice that the Primary DNS Server has changed and the
secondary is missing but everything else is the same

IP Address: 192.168.1.63
Subnet Mask 255.255.255.0
Default Gateway: 192.168.1.254
DHCP Server: 192.168.1.2
DNS Servers: 192.168.2.1
Primary WINS Server: 192.168.1.2

After a renew and release…All is back to normal

IP Address: 192.168.1.63
Subnet Mask 255.255.255.0
Default Gateway: 192.168.1.254
DHCP Server: 192.168.1.2
DNS Servers: 192.168.1.2
192.168.1.1
Primary WINS Server: 192.168.1.2

I’m not sure what’s going on but it is strange….It is happening to more than
one machine but not all of them….I going to swap out two switches and see if
that makes a difference, but I would think I would have more random issues if
a switch was flaking out on me???

Thanks again,

Rob
 
Back
Top