Windows Forum

Ask something
Discussion Locked

MSHome.net taking over DNS settings

0 helpful
6 replies

by awarner 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hi all, I've got a network with all Windows XP or 2000 clients. I use NetWare's DHCP to dish out IP addresses to the clients. Over the past 4 to 5 days, people are calling saying they cannot access the internet. This occurs at random to anyone at any time. When doing an IPCONFIG, I see that the IP, subnet and gateway are fine, but the DNS is set to MSHOME.NET with a DNS address of 192.168.0.1. I do an IPCONFIG /RENEW and they get their proper DNS settings back and internet access returns. Within a couple hours, they call again and I see that their DNS is back to MSHOME.NET etc... What on Earth is doing this and why is it happening out of the blue?? Doesn't happen to everyone, only about 20 out of 200 machines have reported this issue. No malware or viral activity shows up and Microsoft mentions nothing about this on their ICS support docs. HELP!

6 replies

by awarner

Robo_Dev, thanks for the advice. So far I have not found a rogue DHCP server nor can I locate a specific machine that has ICS activated. I wish to let this ticket open for now in case there are more ideas, but if I narrow down to one of your two suggestions, the points are gladly yours.
Thanks again!

by nhutchins

I have the same thing happening here. Just started this week and it seems very random. Did you every get it solved? Anyone else have any thoughts?

by vdahlia

Hi,

Me having the same problem here.

I went to the TCP/IP properties in the local area connection properties and key in the DNS server addresses manually. So far they never called me again on their connection error. Till then I am still looking for a fix and permanent solution for this.

by scorpio722

Strange to see this post, we just spent about 1/2 hour on the same issue.

It turned out to be a 'rouge DHCP Server' on the vlan. It was of course unauthorized. Using a pc on the vlan affected we did an arp -a, then tracked the MAC address via standard Cisco commands and located the port. Of course the port was then disabled and that corrected the problem. Of course that user then called for help....can you say "denial of service..."
Hope this gets you in the right direction....

by john.webb

We just had this happen. We did an ipconfig /all to get the ip of the rouge DNS server. On a laptop with LookAtLAN installed, jumped on that VLAN with an IP in the range of the rouge DNS. Started the scan and it gave us the asset number. Just another way to track it down.

This discussion is closed to new replies.