General discussion

Locked

unknown workgroups/domain

By robw ·
When I browse to My Network Places|Entire Network|Microsoft Windows Network I can see my domain. The problem is that other domains or workgroups periodically appear as though someone has plugged in to our network. For instance, today I can see Mshome. Can anyone please tell me if there is any way to find out where this Workgroup/Domain is coming from.

This conversation is currently closed to new comments.

21 total posts (Page 1 of 3)   01 | 02 | 03   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by w2ktechman In reply to unknown workgroups/domain

to tell if it is an internal or external, try going to a command prompt and type
tracert %domain name, computer name, or ip address%
Example: tracert mshome

this will tell you which routers it took to get to the destination domain/computer.
most likely it is a computername from a nearby computer. If you are a home user you may need to lock down your system/network.

Collapse -

by robw In reply to

It says unable to resolve target system name
Thanks for trying

Collapse -

by Albert Franco II In reply to unknown workgroups/domain

what is your environment? Are you a home user with a small local network?

What opertaing system (including service pack data) are you using?

What are the settings in you network setup? Do you only have the TCP/IP protocol setup? Do you have othe protocols configured?

Have you allowed network sharing on your internet adapter? You should always disable file and printer sharing for the adapter that connects to the internet. If you think it may be this then add a comment i will give you a step by step procedure once you tell me which operating system you have.

Depending on your situation it is probably advisable that you add a firewall such as ZoneAlarm (there are others too, but I'd need more info in order to advise you)

Collapse -

by robw In reply to

Business Environment
100 user network / No wireless
only TCP/IP
CISCO PIX Firewall

Collapse -

by w2ktechman In reply to unknown workgroups/domain

go to administrative tools in control panel.
go to computer management.
go to shared folders
check your shares, sessions, and open files. If anything is being accessed you can terminate their session here.

Then go to Local Users and Groups -- users -- administrator
rename the account (right click and choose Rename"
Again right click it and choose "change Password"
create at least an 8 character alphanumeric password W/special characters.
Disable "Guest" and any other user that was not created by you.

Go to the control panel and double click System icon.
Find the tab marked Remote.
Uncheck "allow users to connect remotely to this computer".
Then go to "Local Area Connections" properties.
In the advanced tab place a checkmark in protect my computer..... for the internet firewall.

This is a good start for protecting the systems from intrusion.

As far as finding the other systems that "appear" these instructions should limit the access to your network (if all of the systems were setup like this". They probably have personal firewalls on their systems to keep you from using "Ping", "Tracert", "nslookup", etc. So the best thing to do is protect yourself.
Also, they may have installed a "back door" on your system, so if it continues, My best suggestion is to rebuild the system(s), and set them up for protection.

Collapse -

by robw In reply to

Our security is quite advanced. What we don't have is a way to monitor if an employee is plugging a unauthorized laptop in to the network. I do not see any workstations appearing in DNS.
This may be due to the fact that I may see the extra domain after the fact. There is no alarm bell which goes off when it appears so it may be disconneted by the time I browse my network places but is still visible under my network places.

Collapse -

by Whatme? In reply to unknown workgroups/domain

This sounds like you or someone has plugged a laptop (or another workstation not on your network...but probably a laptop). The default computer name for a laptop with XP home version is MSHome when purchased. You can actually log onto a network (if your security is not set tight enough)using a valid username and password.The MSHome workgroup can reside in network places for awhile. If it is disconnected or turned off, you of course won't be able to open it. Check your DNS server for the IP address of MSHome.

Collapse -

by robw In reply to

I think that you are on the right track.
I see no extra workstations/IPs under DNS. This may be due to the fact that I may see the extra domain after the fact. There is no alarm bell which goes off when it appears so it may be disconneted by the time I browse my network places but is still visible under my network places.

Collapse -

by CG IT In reply to unknown workgroups/domain

Yep to Whatme's answer. If someone plugs in on the LAN and their computer is NOT a member of the domain [doesn't have a computer account on the domain], the default "workgroup" name will appear in My Network places along with the Network Domain. The default workgroup name will disappear once that computer in unplugged [takes a while].

Collapse -

by CG IT In reply to

I would check the security logs in Event Viewer to see if someone was trying to hack in. Sounds to me like someone within the company brought in their personal laptop and plugged in most likely to see if they could get in.

Back to Windows Forum
21 total posts (Page 1 of 3)   01 | 02 | 03   Next

Related Discussions

Related Forums