Re: DhcpNameServer changes after login

Interesting. I would also run rsop.msc on the computer and look for any
configuration under computer configuration/administrative
templates/network/dnsclient. The other thing you could try is to enable
auditing of process tracking in Local Security Policy to see what
processes/executables are running as shown in the security log just before
you see the change with regmon and also use filemon to see if it can tell
anything useful. --- Steve


"Spinnerdog" <Spinnerdog@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C1932133-3DFD-4F1B-BFBC-CBF3FDB31F6A@xxxxxxxxxxxxxxxx
Thanks for the suggestion. The DHCP server address does not change. I
also
place my laptop on the network, with firewall turned off, and it never
changed. I suspect one of their standard applications is making the
change
but don't know of a way to trace calls to svchost.

"Steven L Umbach" wrote:

Does it show that the computer has a new DHCP server also with ipconfig
/all?? If so you may have an unauthorized DHCP server/device on your
network. It is curious that the computer would change so fast as DHCP
leases
are usually 8 days unless you or the computer are using something like
ipconfig /release and renew or a scrip that uses netsh command to
reconfigure the settings. I would also run rsop.msc to see if any Group
Policy settings [including scripts] are enforcing DNS servers in computer
configuration. You may also want to post in the server.networking
newsgroup. --- Steve


"Spinnerdog" <Spinnerdog@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:56D3934F-7555-4086-86B9-F77D589DCCCF@xxxxxxxxxxxxxxxx
On a network with Server 2003 providing Active Directory and all its
elements, includeing DHCP and DNS, the name servers change a few
seconds
after login. On any workstation running "ipconfig /all" within 30
seconds
of
login shows the internal DNS servers but a few seconds later running
"ipconfig /all" shows external non-related DNS servers.

Using RegMON I can tell svchost is changing the registry but I don't
know
how to determin what is calling svchost. I've also used HiJackThis and
found
nothing unusual in the registry or startup. The external nameservers
are
not
listed in the registry, at least not as text either.







.

Relevant Pages

  • Re: DHCP Problem causing ip to be 169.X.X.X and not 192.168.X.X
    ... their configuration to limit the number of clients they will serve DHCP to. ... If your router was set up by your ISP, they may have set this to just the ... and use what it is using for DNS servers. ...
    (microsoft.public.windowsxp.network_web)
  • Re: DHCP Problem causing ip to be 169.X.X.X and not 192.168.X.X
    ... > their configuration to limit the number of clients they will serve DHCP to. ... My linksys router is set to 50. ... Did that and my virus checker, still no ip address from DHCP on the linksys. ... and use what it is using for DNS servers. ...
    (microsoft.public.windowsxp.network_web)
  • Re: IP Connection Choose Static or DHCP
    ... To set static ip addresses you'll need to edit the registry. ... The settings with their names and descriptions can be found here: ... However at a few sites they have DHCP ... and gateway, or change the configuration to DHCP, then renew the address. ...
    (microsoft.public.pocketpc.developer.networking)
  • Re: Confuguring DNS infrastructure of multisite multidomain network
    ... The fact there are some DCs (which are also DNS servers) that had been ... Registry value: DnsAvoidRegisterRecords ... Is it worth doing this configuration? ...
    (microsoft.public.win2000.active_directory)
  • Re: DNS not getting dynamic updates from DHCP
    ... Only use internal DNS servers when part of an Active Directory domain. ... This is a requirement for DNS registration and DNS resolution even if the client is not actually using DHCP. ... Current Configuration: ...
    (microsoft.public.windows.server.dns)
Loading