Very strange DHCP Issue...

I recently took over support for a small office (10 people) from another
company. Everything has gone fine for the last week. No issues at all.
Suddenly, I had users this morning complaining that they had no internet
connection. I checked their connection settings using ipconfig /all and
noticed that their DNS server was listed as 192.168.15.1 when it should have
been 192.168.1.10.

I checked the DHCP settings on the server and they were all correct. I
verified the database. It was fine. I asked the users to simply right-click
their connection and select "repair". This fixed everyone. They had all of
their settings updated to the correct settings including DNS server settings.
Except that about every 20 minutes, the settings change back to the bad IP
address. This address is not in their subnet. Have never existed on the
server or the DHCP setting and I can't for the life of me figure out where
the client machines are pulling this setting from?

When I took over support for the company, I stupidly, forgot to change the
Administrator password. It's possible the the old company being upset that
they are not handling support anymore and trying to make me look bad have
logged in and changed something but I can't figure out what it might be that
would make all the client computers behave this way, constantly re-setting
their DNS server IP address to a non-existent server? If they right-click and
select "repair" it pulls the correct settings from the DHCP server and all is
well again for 20 minutes, but of course they don't want to have to do this
all day long.

ANY IDEAS what might be going on here?

Hello John,

How is the gateway configured? Maybe there is also a DHCP server running
on it?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> I recently took over support for a small office (10 people) from
> another company. Everything has gone fine for the last week. No issues
> at all. Suddenly, I had users this morning complaining that they had
> no internet connection. I checked their connection settings using
> ipconfig /all and noticed that their DNS server was listed as
> 192.168.15.1 when it should have been 192.168.1.10.
>
> I checked the DHCP settings on the server and they were all correct. I
> verified the database. It was fine. I asked the users to simply
> right-click their connection and select "repair". This fixed everyone.
> They had all of their settings updated to the correct settings
> including DNS server settings. Except that about every 20 minutes, the
> settings change back to the bad IP address. This address is not in
> their subnet. Have never existed on the server or the DHCP setting and
> I can't for the life of me figure out where the client machines are
> pulling this setting from?
>
> When I took over support for the company, I stupidly, forgot to change
> the Administrator password. It's possible the the old company being
> upset that they are not handling support anymore and trying to make me
> look bad have logged in and changed something but I can't figure out
> what it might be that would make all the client computers behave this
> way, constantly re-setting their DNS server IP address to a
> non-existent server? If they right-click and select "repair" it pulls
> the correct settings from the DHCP server and all is well again for 20
> minutes, but of course they don't want to have to do this all day
> long.
>
> ANY IDEAS what might be going on here?
>

Nope. That was the first thing that I checked.

"Meinolf Weber" wrote:

> Hello John,
>
> How is the gateway configured? Maybe there is also a DHCP server running
> on it?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
>
> > I recently took over support for a small office (10 people) from
> > another company. Everything has gone fine for the last week. No issues
> > at all. Suddenly, I had users this morning complaining that they had
> > no internet connection. I checked their connection settings using
> > ipconfig /all and noticed that their DNS server was listed as
> > 192.168.15.1 when it should have been 192.168.1.10.
> >
> > I checked the DHCP settings on the server and they were all correct. I
> > verified the database. It was fine. I asked the users to simply
> > right-click their connection and select "repair". This fixed everyone.
> > They had all of their settings updated to the correct settings
> > including DNS server settings. Except that about every 20 minutes, the
> > settings change back to the bad IP address. This address is not in
> > their subnet. Have never existed on the server or the DHCP setting and
> > I can't for the life of me figure out where the client machines are
> > pulling this setting from?
> >
> > When I took over support for the company, I stupidly, forgot to change
> > the Administrator password. It's possible the the old company being
> > upset that they are not handling support anymore and trying to make me
> > look bad have logged in and changed something but I can't figure out
> > what it might be that would make all the client computers behave this
> > way, constantly re-setting their DNS server IP address to a
> > non-existent server? If they right-click and select "repair" it pulls
> > the correct settings from the DHCP server and all is well again for 20
> > minutes, but of course they don't want to have to do this all day
> > long.
> >
> > ANY IDEAS what might be going on here?
> >
>
>
>

"John Riddle" <(E-Mail Removed)> wrote in message
news42C8C2A-40A5-45D4-B878-(E-Mail Removed)...
>I recently took over support for a small office (10 people) from another
> company. Everything has gone fine for the last week. No issues at all.
> Suddenly, I had users this morning complaining that they had no internet
> connection. I checked their connection settings using ipconfig /all and
> noticed that their DNS server was listed as 192.168.15.1 when it should
> have
> been 192.168.1.10.
>
> I checked the DHCP settings on the server and they were all correct. I
> verified the database. It was fine. I asked the users to simply
> right-click
> their connection and select "repair". This fixed everyone. They had all of
> their settings updated to the correct settings including DNS server
> settings.
> Except that about every 20 minutes, the settings change back to the bad IP
> address. This address is not in their subnet. Have never existed on the
> server or the DHCP setting and I can't for the life of me figure out where
> the client machines are pulling this setting from?
>
> When I took over support for the company, I stupidly, forgot to change the
> Administrator password. It's possible the the old company being upset that
> they are not handling support anymore and trying to make me look bad have
> logged in and changed something but I can't figure out what it might be
> that
> would make all the client computers behave this way, constantly re-setting
> their DNS server IP address to a non-existent server? If they right-click
> and
> select "repair" it pulls the correct settings from the DHCP server and all
> is
> well again for 20 minutes, but of course they don't want to have to do
> this
> all day long.
>
> ANY IDEAS what might be going on here?


It may be a group policy overriding the setting. This is consistent with the
20 minute update.

http://support.microsoft.com/?id=294785

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca

John Riddle wrote:
> When I took over support for the company, I stupidly, forgot to change the
> Administrator password. It's possible the the old company being upset that
> they are not handling support anymore and trying to make me look bad have
> logged in and changed something but I can't figure out what it might be that
> would make all the client computers behave this way, constantly re-setting
> their DNS server IP address to a non-existent server? If they right-click and
> select "repair" it pulls the correct settings from the DHCP server and all is
> well again for 20 minutes, but of course they don't want to have to do this
> all day long.
>
> ANY IDEAS what might be going on here?

Find a machine that has been assigned one of these addresses from the
wrong range, bring up the network adapter info via the GUI or ipconfig
/all and see what the IP address of the DHCP server is.

That'll give you a better idea of where to start looking :-)

--
Chris.

Chris M wrote:
> John Riddle wrote:
>> When I took over support for the company, I stupidly, forgot to change
>> the Administrator password. It's possible the the old company being
>> upset that they are not handling support anymore and trying to make me
>> look bad have logged in and changed something but I can't figure out
>> what it might be that would make all the client computers behave this
>> way, constantly re-setting their DNS server IP address to a
>> non-existent server? If they right-click and select "repair" it pulls
>> the correct settings from the DHCP server and all is well again for 20
>> minutes, but of course they don't want to have to do this all day long.
>> ANY IDEAS what might be going on here?
>
> Find a machine that has been assigned one of these addresses from the
> wrong range, bring up the network adapter info via the GUI or ipconfig
> /all and see what the IP address of the DHCP server is.
>
> That'll give you a better idea of where to start looking :-)
>

Actually, scratch that. It's much more likely to be a group policy
setting like Kerry has said :-)


--
Chris.