Default Gateway Reverts to Old Setting

Having a problem with the default gateway setting on a WinSvr2003 Std box at
one of my clients.

This server is on the only IP subnet at the client's main office. It's
configured as a DC with another DC on the subnet, which is an SBS2003
Premium box which holds all the FSMO roles. Both DCs run DNS for the
domain, but onlly the SBS2003 server runs WINS.

The server has two identical 10/100/1000 NICs, plus a (Broadcom) BASP
Virtual Adapter which is part of optional NIC teaming. We're not doing any
of the teaming, and the BASP Virtual Adapter and one of the physical NICs
are disabled.

We re-numbered the IP subnet in this office as part of a IP numbering
architecture involving several branch offices VPNs with this main office as
the VPN hub. The previous subnet was 192.168.0.0/24 with the old default
gateway at 192.168.0.1. The renumbered subnet is 192.168.60.0/24 with the
default gateway at 192.168.60.254.

The server has static IP addressing on the active NIC. TCP/IP properties
are left to use DHCP on the two disabled NICs, not that it should matter.
TCP/IP is the only network protocol installed. DNS & WINS are set
correrctly and NetBIOS is enabled on the active NIC. Advanced Settings in
Network Properties look right as to sequence and protocol bindings.

The problem is that the default gateway setting for the active NIC keeps
reverting back to 192.168.0.1 from 192.168.60.254 at random times. After
it's set correctly, it'll revert back after the server runs for some period
of time. It may revert back after a reboot (but not always), overnight
(during which a backup normally occurs, using BackupExec Remote Agent) or
just after a few hours.

I've re-set the default gateway numerous times, but it always reverts back
to the old, now non-existent IP. I've searched the registry many times and
removed or updated any reference to the old 192.168.0.x network. I've also
changed which NIC is the active one and set the IP addressing correctly on
the new one only to have the gateway get changed to the old 192.18.0.1 one
on that NIC which had never been on that old network. Haven't found
anything on-point in the Microsoft Support KnowledgeBase.

We're at the point now of maybe removing/reinstalling the TCP/IP and/or
networking software on this box. But we don't know if that will cure this
and it's a hassle anyway.

Anyone have any ideas?

Thanks,
DD

Anyone have any i

In news:%(E-Mail Removed),
DukieDallas <(E-Mail Removed)> stated, which I commented on below:
> Having a problem with the default gateway setting on a WinSvr2003 Std
> box at one of my clients.
>
> This server is on the only IP subnet at the client's main office. It's
> configured as a DC with another DC on the subnet, which is an
> SBS2003 Premium box which holds all the FSMO roles. Both DCs run DNS
> for the domain, but onlly the SBS2003 server runs WINS.
>
> The server has two identical 10/100/1000 NICs, plus a (Broadcom) BASP
> Virtual Adapter which is part of optional NIC teaming. We're not
> doing any of the teaming, and the BASP Virtual Adapter and one of the
> physical NICs are disabled.
>
> We re-numbered the IP subnet in this office as part of a IP numbering
> architecture involving several branch offices VPNs with this main
> office as the VPN hub. The previous subnet was 192.168.0.0/24 with
> the old default gateway at 192.168.0.1. The renumbered subnet is
> 192.168.60.0/24 with the default gateway at 192.168.60.254.
>
> The server has static IP addressing on the active NIC. TCP/IP
> properties are left to use DHCP on the two disabled NICs, not that it
> should matter. TCP/IP is the only network protocol installed. DNS &
> WINS are set correrctly and NetBIOS is enabled on the active NIC. Advanced
> Settings in Network Properties look right as to sequence and
> protocol bindings.
> The problem is that the default gateway setting for the active NIC
> keeps reverting back to 192.168.0.1 from 192.168.60.254 at random
> times. After it's set correctly, it'll revert back after the server
> runs for some period of time. It may revert back after a reboot (but
> not always), overnight (during which a backup normally occurs, using
> BackupExec Remote Agent) or just after a few hours.
>
> I've re-set the default gateway numerous times, but it always reverts
> back to the old, now non-existent IP. I've searched the registry
> many times and removed or updated any reference to the old
> 192.168.0.x network. I've also changed which NIC is the active one
> and set the IP addressing correctly on the new one only to have the
> gateway get changed to the old 192.18.0.1 one on that NIC which had
> never been on that old network. Haven't found anything on-point in
> the Microsoft Support KnowledgeBase.
> We're at the point now of maybe removing/reinstalling the TCP/IP
> and/or networking software on this box. But we don't know if that
> will cure this and it's a hassle anyway.
>
> Anyone have any ideas?
>
> Thanks,
> DD
>
> Anyone have any i

Only thing I can think of is there is some 3rd party software running that
may be causing this. Can you list what's installed even as minuscule as it
may sound? Something is doing it. Maybe a firewall or security app, if it's
Terminal Server, maybe something a user installed, etc.

--
Ace
Innovative IT Concepts, Inc
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

Thanks for the reply.

From Add/Remove Programs:
Adobe Download Manager 2.0
Adobe Reader 7.0.5
ATI Display Driver
Belarc Advisor 7.0
LightningFAX 8.2.0.73
LiveUpdate 2.6 (Symantec)
Macromedia Flash Player 8.0
Microsoft .NET Framework 2.0
Microsoft Exchange (is really just the Exch System Tools for LightningFAX)
Shadow Copy Client
Synamtec AntiVirus
Symantec Backup Exec Remote Agent for Windows Servers
Symantec System Center
VNC Free Edition 4.1.1
WebEx (left over from a LightningFAX support session, after the IP subnet
change)
Windows 2000 Administration Tools (system was upgraded from Win2000Svr)
Windows Server 2003 Service Pack 1
Windows Support Tools

Apart from Add/Remove Programs, the server also has
DataPro (accounting application...really just the programs and data files,
as a pure file server for them)
Alarms (an old 16bit, "DOS" app for alarm companies)

Aside from those apps and the DC role, this is purely a file server.

Thanks,
DD


"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
<snipped>
> Only thing I can think of is there is some 3rd party software running that
> may be causing this. Can you list what's installed even as minuscule as it
> may sound? Something is doing it. Maybe a firewall or security app, if
> it's Terminal Server, maybe something a user installed, etc.
>
> --
> Ace
> Innovative IT Concepts, Inc
> Willow Grove, PA
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> Having difficulty reading or finding responses to your post?
> Instead of the website you're using, I suggest to use OEx (Outlook Express
> or any other newsreader), and configure a news account, pointing to
> news.microsoft.com. This is a direct link to the Microsoft Public
> Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows
> you to easily find, track threads, cross-post, sort by date, poster's
> name, watched threads or subject.
> It's easy:
>
> How to Configure OEx for Internet News
> http://support.microsoft.com/?id=171164
>
> Infinite Diversities in Infinite Combinations
> Assimilation Imminent. Resistance is Futile
> "Very funny Scotty. Now, beam down my clothes."
>
> The only constant in life is change...

In news:%(E-Mail Removed),
DukieDallas <(E-Mail Removed)> stated, which I commented on below:
> Thanks for the reply.
>
> From Add/Remove Programs:
> Adobe Download Manager 2.0
> Adobe Reader 7.0.5
> ATI Display Driver
> Belarc Advisor 7.0
> LightningFAX 8.2.0.73
> LiveUpdate 2.6 (Symantec)
> Macromedia Flash Player 8.0
> Microsoft .NET Framework 2.0
> Microsoft Exchange (is really just the Exch System Tools for
> LightningFAX) Shadow Copy Client
> Synamtec AntiVirus
> Symantec Backup Exec Remote Agent for Windows Servers
> Symantec System Center
> VNC Free Edition 4.1.1
> WebEx (left over from a LightningFAX support session, after the IP
> subnet change)
> Windows 2000 Administration Tools (system was upgraded from
> Win2000Svr) Windows Server 2003 Service Pack 1
> Windows Support Tools
>
> Apart from Add/Remove Programs, the server also has
> DataPro (accounting application...really just the programs and data
> files, as a pure file server for them)
> Alarms (an old 16bit, "DOS" app for alarm companies)
>
> Aside from those apps and the DC role, this is purely a file server.
>
> Thanks,
> DD

Thanks for posting this stuff. Does Symantec System Center have any controls
on server settings? How about Lightning Fax? The rest don't appear they
would have anything to do with it. If you ran Belarc after you changed the
settings, then ran it again, does it recognize the change in the gateway?

Do these files exist anywhere on your system?
VSMONAPI.DLL
VSUTIL.DLL

Ace

Thanks for the further questions/ideas, Ace.

No VS*.DLL anywhere on this system.

LightningFAX was installed about 45 days after the IP network renumbering.
I've also searched all LightningFAX folders & files for any file with
192.168.0 in it. Nothing. Of course, if an IP address was in an encoded
file, I wouldn't see it with that search. However, I believe LightningFAX
does some license checking with home base when it was installed, so if the
gateway was wrong at that time, it would have failed.

Checked Symanted System Center content and documentation. The only thing
that comes close caring about default gateway are the NetSpecs controls for
Symantec Client Firewall. But this customerdoesn't have Symantec Client
Firewall installed anywhere.

Oddly enough, I think I may have inadvertently done something the day after
my post that might have solved the problem. While combing through the
network connections' properties for the zillionth time, I noticed that the
Authentication tab for the active LANconnection had the "Enable IEEE 802.1x
authentication" checkbox checked, with "Smart Car or other Certificate"
selected in EAP type and the "Authenticate as computer when..." checkbox
checked.

Since we're not using any 802.1x port-based authentication for network
access, I decided to turn that off. The gateway has remained correct for
over 48 hours now, which is a record I'm sure. I can't yet explain why that
would matter, but ..... don't look a gift horse in the mouth.

DD

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> In news:%(E-Mail Removed),
> DukieDallas <(E-Mail Removed)> stated, which I commented on
> below:
<snipped>
> Thanks for posting this stuff. Does Symantec System Center have any
> controls on server settings? How about Lightning Fax? The rest don't
> appear they would have anything to do with it. If you ran Belarc after you
> changed the settings, then ran it again, does it recognize the change in
> the gateway?
>
> Do these files exist anywhere on your system?
> VSMONAPI.DLL
> VSUTIL.DLL
>
> Ace
>

In news:(E-Mail Removed),
DukieDallas <(E-Mail Removed)> stated, which I commented on below:
> Thanks for the further questions/ideas, Ace.
>
> No VS*.DLL anywhere on this system.
>
> LightningFAX was installed about 45 days after the IP network
> renumbering. I've also searched all LightningFAX folders & files for
> any file with 192.168.0 in it. Nothing. Of course, if an IP address
> was in an encoded file, I wouldn't see it with that search. However,
> I believe LightningFAX does some license checking with home base when
> it was installed, so if the gateway was wrong at that time, it would
> have failed.
> Checked Symanted System Center content and documentation. The only
> thing that comes close caring about default gateway are the NetSpecs
> controls for Symantec Client Firewall. But this customerdoesn't have
> Symantec Client Firewall installed anywhere.
>
> Oddly enough, I think I may have inadvertently done something the day
> after my post that might have solved the problem. While combing
> through the network connections' properties for the zillionth time, I
> noticed that the Authentication tab for the active LANconnection had
> the "Enable IEEE 802.1x authentication" checkbox checked, with "Smart
> Car or other Certificate" selected in EAP type and the "Authenticate
> as computer when..." checkbox checked.
>
> Since we're not using any 802.1x port-based authentication for network
> access, I decided to turn that off. The gateway has remained correct
> for over 48 hours now, which is a record I'm sure. I can't yet
> explain why that would matter, but ..... don't look a gift horse in
> the mouth.
> DD

A *miracle* ? :-)

The IEEE and cert settings wouldn't really have anything to do with it, from
what I see. Another thought was RRAS, which I forgot to ask about.

Well, leave enough alone. Just don't forget to check it after your next
update and restart.

Ace

Below.

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:%23%(E-Mail Removed)...
> In news:(E-Mail Removed),
> DukieDallas <(E-Mail Removed)> stated, which I commented on
> below:
>> Thanks for the further questions/ideas, Ace.
>>
>> No VS*.DLL anywhere on this system.
>>
>> LightningFAX was installed about 45 days after the IP network
>> renumbering. I've also searched all LightningFAX folders & files for
>> any file with 192.168.0 in it. Nothing. Of course, if an IP address
>> was in an encoded file, I wouldn't see it with that search. However,
>> I believe LightningFAX does some license checking with home base when
>> it was installed, so if the gateway was wrong at that time, it would
>> have failed.
>> Checked Symanted System Center content and documentation. The only
>> thing that comes close caring about default gateway are the NetSpecs
>> controls for Symantec Client Firewall. But this customerdoesn't have
>> Symantec Client Firewall installed anywhere.
>>
>> Oddly enough, I think I may have inadvertently done something the day
>> after my post that might have solved the problem. While combing
>> through the network connections' properties for the zillionth time, I
>> noticed that the Authentication tab for the active LANconnection had
>> the "Enable IEEE 802.1x authentication" checkbox checked, with "Smart
>> Car or other Certificate" selected in EAP type and the "Authenticate
>> as computer when..." checkbox checked.
>>
>> Since we're not using any 802.1x port-based authentication for network
>> access, I decided to turn that off. The gateway has remained correct
>> for over 48 hours now, which is a record I'm sure. I can't yet
>> explain why that would matter, but ..... don't look a gift horse in
>> the mouth.
>> DD
>
> A *miracle* ? :-)
>
> The IEEE and cert settings wouldn't really have anything to do with it,
> from what I see. Another thought was RRAS, which I forgot to ask about.
>
> Well, leave enough alone. Just don't forget to check it after your next
> update and restart.
>
> Ace

Nope, no RRAS. VPN & remote access are handled by a separate hardware
firewall. I rebooted the server before my last post, and the correct
gateway stuck and is still there. Don't worry, I'll continue to check.

Thanks,
DD

In news:%(E-Mail Removed),
DukieDallas <(E-Mail Removed)> stated, which I commented on below:
>
> Nope, no RRAS. VPN & remote access are handled by a separate hardware
> firewall. I rebooted the server before my last post, and the correct
> gateway stuck and is still there. Don't worry, I'll continue to
> check.
> Thanks,
> DD

If it's still in there, then no worries!

Post back if you have any other problems.

Ace

I am having the exact same problem on 2003 Standard Server Box. The
gateway address reverts to the an older (non-existant address)
whenever someone logs in using remote desktop connection or a reboot
and console login. This server is a member server in a SBS2003 domain.
I believe there is a configuration script running whenever someone
logs on to console or to a remote connection causing this problem.

Since moving to 2003 SBS from 2000 Server I see there is a text window
which flashes breifly as users log in . Box title is the name of the
SBS2003 server. This must be a script running at login. This is
precisely when the gateway is changed to the old address.

Kevin Miller


Ace Fekay [MVP] wrote:
> In news:%(E-Mail Removed),
> DukieDallas <(E-Mail Removed)> stated, which I commented on below:
> >
> > Nope, no RRAS. VPN & remote access are handled by a separate hardware
> > firewall. I rebooted the server before my last post, and the correct
> > gateway stuck and is still there. Don't worry, I'll continue to
> > check.
> > Thanks,
> > DD
>
> If it's still in there, then no worries!
>
> Post back if you have any other problems.
>
> Ace

In news:(E-Mail Removed) ps.com,
(E-Mail Removed) <(E-Mail Removed)> stated,
which I commented on below:
> I am having the exact same problem on 2003 Standard Server Box. The
> gateway address reverts to the an older (non-existant address)
> whenever someone logs in using remote desktop connection or a reboot
> and console login. This server is a member server in a SBS2003
> domain. I believe there is a configuration script running whenever
> someone logs on to console or to a remote connection causing this
> problem.
>
> Since moving to 2003 SBS from 2000 Server I see there is a text window
> which flashes breifly as users log in . Box title is the name of the
> SBS2003 server. This must be a script running at login. This is
> precisely when the gateway is changed to the old address.
>
> Kevin Miller

If it's an SBS script, (I'm trying to remember where it's indicated), go
into the GPMC, and look under the domain level for all the GPOs. I can't
remember which GPO it's in, but check them all. You'll also want to check
the Small Business Serer OU (can't remember the exact name of the OU), and
look in there. If you can't find it in a GPO, check the NETLOGON folder.

Ace