Windows Forum

Ask something
Discussion Locked

Win2k srvrs missing from Network N-hood

0 helpful
7 replies

by posterkid 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

About every hour or so, 99% of our servers are
disappearing out of Network Neighborhood. By rebooting our DC with PDC emulator FSMO,(we still call it the PDC) the following is logged in system log:

Event ID: 8015
The browser has forced an election on network
\Device\NetBT_Tcpip_{F14D830F-DA96-4858-99EE-DE2ECD1364 8C}
because a Windows 2000 Server (or domain master) browser
is started.

It appears that another device is assuming domain browsing responsabilites away from the PDC even though it is still up and functional, but I may be wrong. There is no event message stating that the PDC has lost domain browsing rights. Again, a reboot of the PDC temporarily fixes the
problem, and generates the above event.

This has just started recently, over the past few days.The only thing I can think of that has changed, is the decommission of a DC that was a WINS and DNS server, and a recommision of a DC on new hardware, and an update of remaining servers to sp4.

Info:
Flat LAN, no routing
Win2k AD Native mode
14 DC's
All servers(DC and member)are Win2k sp4, or Win2k Adv server sp4. One WinNT4.0 server sp6
hub/spoke WINS topology
PDC is hub, with 7 subordinates in a push/pull replication with the pdc only. They do not rep with each other.
Help!! this is really frustrating.

7 replies

by cg it

this usually happens when a computer off the domain network uses the same LAN [same router]to directly access the internet[circumventing the domain's proxy server]. That computer's browser is a master browser for that computer [because it's stand alone] whereas in the domain, domain users have to use the proxy server as their internet access [or ISA server if used]. The DC picks up that LAN traffic and reports in the event viewer there's another computer on the LAN that says its the master browser. I see that event viewer "event" on my PDC as I have one computer off the domain that uses the domain's ISP & router for internet access [bosses personal laptop which he doesn't want to connect to the domain]. I periodically check the SID to make sure it's his laptop. Just in case.

by cg it

in my case I already knew which computer, the bosses, as I set up the connection for him.

Tracking down a rogue computer shouldn't be to hard if their using the domain's router. The router logs [most good routers had a log of inbound outbound traffic] tell what's going where and when.

by cg it

network neighborhood isn't going to tell you anything that your looking for. Even my networks places won't. That's because what your looking at from the domain network is what's behind the computer/server/DC used as the gateway. Check the router logs to see if there is traffic to an IP address that isn't in the domain.

by posterkid

How did you find which computer is off the domain, and broadcasting it's master browser status? I looked, and didn't see any other workgroups/domains listed in network neighborhood. Outside of checking each computer on the LAN (1200+), i don't know how to track this rouge computer down.

by fighter_ir

hi
maybe you hav eproblem in your hubs. your nwteork devices. or maybe u are using some firewall software. or u have more than 1 NIC on your server. tell more about your site map and services on your network.

This discussion is closed to new replies.