Unknown workgroups/domain when browsing network

[msnews]

Unknown workgroups/domain when browsing network

When I browse to My Network Places|Entire Network|Microsoft Windows Network
I can see my domain.

The problem is that other domains or workgroups periodically appear as
though someone has plugged in to our network. For instance, today I can see
Mshome.

We have network with 3 locations connected via CISCO PIX Firewall and CISCO
ROUTER CONTROLLED IPSec VPN.
ADS used with single domain.
Dynamic DHCP is used to dole out IPs.
Static is not feasible.
Most likely problem is that someone is plugging an unauthorized laptop in to
the network at an available outlet at one of the locations.

This may be due to the fact that I may see the extra domain after the fact.
There is no alarm bell which goes off when it appears so it may be
disconneted by the time I browse my network places but is still visible
under my network places.
I see no extra workstations/IPs under DNS. This may be due to the fact that
I may see the extra domain after the fact. There is no alarm bell which goes
off when it appears so it may be disconneted by the time I browse my network
places but is still visible under my network places


Can anyone please tell me if there is any way to find out where this
Workgroup/Domain is coming from (Pin it down to an IP).

 

[Lanwench [MVP - Exchange]]

Unknown workgroups/domain when browsing network

When I browse to My Network Places|Entire Network|Microsoft Windows
Network I can see my domain.

The problem is that other domains or workgroups periodically appear as
though someone has plugged in to our network. For instance, today I
can see Mshome.

We have network with 3 locations connected via CISCO PIX Firewall and
CISCO ROUTER CONTROLLED IPSec VPN.
ADS used with single domain.
Dynamic DHCP is used to dole out IPs.
Static is not feasible.

Statics wouldn't help you, anyway. DHCP reservations for all 'permitted'
computers, with nothing available in the range without a reservation, is one
cheap/cheerful way to prevent this, but it is a huge PITA and I don't
recommend it -

Most likely problem is that someone is plugging an unauthorized
laptop in to the network at an available outlet at one of the
locations.

Yes, you're correct - that's the most likely cause.

This may be due to the fact that I may see the extra domain after the
fact. There is no alarm bell which goes off when it appears so it may
be disconneted by the time I browse my network places but is still
visible under my network places.
I see no extra workstations/IPs under DNS. This may be due to the
fact that I may see the extra domain after the fact. There is no
alarm bell which goes off when it appears so it may be disconneted by
the time I browse my network places but is still visible under my
network places


Can anyone please tell me if there is any way to find out where this
Workgroup/Domain is coming from (Pin it down to an IP).

Not if the computer configured for that workgroup/domain is no longer
connected to your network.