why does the XP client request a dns zone transfer?

I have noticed log-entries on the DNS server that indicates that one or more
clients (XP) are requesting zone transfers for the domain. As I am not aware
of any reason a client should need a zone transfer this bothers me. There is
no services running on the client that I should think would initiate a zone
transfer, and no indication in the eventlog that such an action has been
taken.

Do I have a security problem?

Are the XP clients requesting the zone transfer at SP1 or SP2? This might
be related to the article below.

Symptoms:
"A Microsoft Windows XP-based client may randomly register service (SRV)
records in Domain Name System (DNS) as if the computer is a new domain
controller in the domain. to authenticate to the domain. When the other
computers on the network query for a domain controller, the Windows XP-based
computer is returned together with the actual domain controllers.
Connectivity problems may be most prevalent when the Windows XP-based
computer that has registered SRV records is shut down."

Cause:
This problem occurs because of an problem with Netlogon and its
initialization. A Windows XP-based computer is more likely to experience
this issue if the following conditions are true:

1. The Windows XP-based computer is restarted.
2. Netlogon begins its initialization process.
3. The computer is shut down before Netlogon fully initializes.

If the computer is shut down during the Netlogon initialization process, the
STATUS_INVALID_SERVER_STATE error code may be returned. The
STATUS_INVALID_SERVER_STATE error code interrupts the Netlogon process and
the Boolean value is not set that prevents the computer from registering SRV
records.

Resolution:
To resolve this problem, obtain the latest service pack for Microsoft
Windows XP

Quoted from:
Netlogon incorrectly registers SRV records in DNS for Windows XP-based
clients:
http://support.microsoft.com/Default.aspx?kbid=825675

--
Todd J Heron, MVP Windows Server - Networking
MCSE - Windows Server 2003/2000/NT; CCA


"Meteor" <(E-Mail Removed)> wrote in message
news:8AE8C234-1638-44D3-A00B-(E-Mail Removed)...
>I have noticed log-entries on the DNS server that indicates that one or
>more
> clients (XP) are requesting zone transfers for the domain. As I am not
> aware
> of any reason a client should need a zone transfer this bothers me. There
> is
> no services running on the client that I should think would initiate a
> zone
> transfer, and no indication in the eventlog that such an action has been
> taken.
>
> Do I have a security problem?