corrupt browse list?

I have a client with a strange issue:

Servers are W2K3 and client XP.
When browsing the network there is a domain that we do not recognized. Let's
say the production domain is called DOM1 and this strange one is calles DOM2.
DOM1 contains a few hundreds of servers and a few thousands of workstations.
When I open the DOM1 domain I find all these servers and workstations as
expected. When I open the DOM2, we see exactly the same list of servers and
workstations! Clicking on one of these machines brings us to the actual
machine in DOM1.

I tried to find the master browser for this DOM2 domain (or workgroup) but
it gives an access denied. I ran Nework Monitor on the domain master browser
(PDC Emulator) of DOM1 to see if there was any announcement of that domain.

Is there any way to find the server that is announcing the DOM2 domain? Or
could it be a corrupt browsing list and how do I solve that? The DOM2 is
around there for at least a couple of days now. It is not registered with our
WINS servers or with DNS.

Thanks in advance...

In news:0DB19634-3818-4D8E-907B-(E-Mail Removed),
highs013 <(E-Mail Removed)> stated, which I commented on
below:
> I have a client with a strange issue:
>
> Servers are W2K3 and client XP.
> When browsing the network there is a domain that we do not
> recognized. Let's say the production domain is called DOM1 and this
> strange one is calles DOM2. DOM1 contains a few hundreds of servers
> and a few thousands of workstations. When I open the DOM1 domain I
> find all these servers and workstations as expected. When I open the
> DOM2, we see exactly the same list of servers and workstations!
> Clicking on one of these machines brings us to the actual machine in
> DOM1.
>
> I tried to find the master browser for this DOM2 domain (or
> workgroup) but it gives an access denied. I ran Nework Monitor on the
> domain master browser (PDC Emulator) of DOM1 to see if there was any
> announcement of that domain.
>
> Is there any way to find the server that is announcing the DOM2
> domain? Or could it be a corrupt browsing list and how do I solve
> that? The DOM2 is around there for at least a couple of days now. It
> is not registered with our WINS servers or with DNS.
>
> Thanks in advance...

Is there some rogue workstation with that name configured as a workgroup
name?

Have you tried browstat.exe?

I wouldn't say there is any 'corrpupt' browse list. The mere fact this is
happening in such a large environment could very well point to a rogue or
test workstation or laptop configured with that name as a workgroup name.


--
Ace
Innovative IT Concepts, Inc (IITCI)
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

We had the same issue on our network. We removed the static entry from
our WINS server and resolved the issue.


Ace Fekay [MVP] wrote:
> In news:0DB19634-3818-4D8E-907B-(E-Mail Removed),
> highs013 <(E-Mail Removed)> stated, which I commented on
> below:
> > I have a client with a strange issue:
> >
> > Servers are W2K3 and client XP.
> > When browsing the network there is a domain that we do not
> > recognized. Let's say the production domain is called DOM1 and this
> > strange one is calles DOM2. DOM1 contains a few hundreds of servers
> > and a few thousands of workstations. When I open the DOM1 domain I
> > find all these servers and workstations as expected. When I open the
> > DOM2, we see exactly the same list of servers and workstations!
> > Clicking on one of these machines brings us to the actual machine in
> > DOM1.
> >
> > I tried to find the master browser for this DOM2 domain (or
> > workgroup) but it gives an access denied. I ran Nework Monitor on the
> > domain master browser (PDC Emulator) of DOM1 to see if there was any
> > announcement of that domain.
> >
> > Is there any way to find the server that is announcing the DOM2
> > domain? Or could it be a corrupt browsing list and how do I solve
> > that? The DOM2 is around there for at least a couple of days now. It
> > is not registered with our WINS servers or with DNS.
> >
> > Thanks in advance...
>
> Is there some rogue workstation with that name configured as a workgroup
> name?
>
> Have you tried browstat.exe?
>
> I wouldn't say there is any 'corrpupt' browse list. The mere fact this is
> happening in such a large environment could very well point to a rogue or
> test workstation or laptop configured with that name as a workgroup name.
>
>
> --
> Ace
> Innovative IT Concepts, Inc (IITCI)
> Willow Grove, PA
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> Having difficulty reading or finding responses to your post?
> Instead of the website you're using, I suggest to use OEx (Outlook Express
> or any other newsreader), and configure a news account, pointing to
> news.microsoft.com. This is a direct link to the Microsoft Public
> Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
> to easily find, track threads, cross-post, sort by date, poster's name,
> watched threads or subject.
> It's easy:
>
> How to Configure OEx for Internet News
> http://support.microsoft.com/?id=171164
>
> Infinite Diversities in Infinite Combinations
> Assimilation Imminent. Resistance is Futile
> "Very funny Scotty. Now, beam down my clothes."
>
> The only constant in life is change...