unknown workgroups/domain

to tell if it is an internal or external, try going to a command prompt and type
tracert %domain name, computer name, or ip address%
Example: tracert mshome

this will tell you which routers it took to get to the destination domain/computer.
most likely it is a computername from a nearby computer. If you are a home user you may need to lock down your system/network.

what is your environment? Are you a home user with a small local network?

What opertaing system (including service pack data) are you using?

What are the settings in you network setup? Do you only have the TCP/IP protocol setup? Do you have othe protocols configured?

Have you allowed network sharing on your internet adapter? You should always disable file and printer sharing for the adapter that connects to the internet. If you think it may be this then add a comment i will give you a step by step procedure once you tell me which operating system you have.

Depending on your situation it is probably advisable that you add a firewall such as ZoneAlarm (there are others too, but I'd need more info in order to advise you)

go to administrative tools in control panel.
go to computer management.
go to shared folders
check your shares, sessions, and open files. If anything is being accessed you can terminate their session here.

Then go to Local Users and Groups -- users -- administrator
rename the account (right click and choose Rename"
Again right click it and choose "change Password"
create at least an 8 character alphanumeric password W/special characters.
Disable "Guest" and any other user that was not created by you.

Go to the control panel and double click System icon.
Find the tab marked Remote.
Uncheck "allow users to connect remotely to this computer".
Then go to "Local Area Connections" properties.
In the advanced tab place a checkmark in protect my computer..... for the internet firewall.

This is a good start for protecting the systems from intrusion.

As far as finding the other systems that "appear" these instructions should limit the access to your network (if all of the systems were setup like this". They probably have personal firewalls on their systems to keep you from using "Ping", "Tracert", "nslookup", etc. So the best thing to do is protect yourself.
Also, they may have installed a "back door" on your system, so if it continues, My best suggestion is to rebuild the system(s), and set them up for protection.

This sounds like you or someone has plugged a laptop (or another workstation not on your network...but probably a laptop). The default computer name for a laptop with XP home version is MSHome when purchased. You can actually log onto a network (if your security is not set tight enough)using a valid username and password.The MSHome workgroup can reside in network places for awhile. If it is disconnected or turned off, you of course won't be able to open it. Check your DNS server for the IP address of MSHome.

Yep to Whatme's answer. If someone plugs in on the LAN and their computer is NOT a member of the domain [doesn't have a computer account on the domain], the default "workgroup" name will appear in My Network places along with the Network Domain. The default workgroup name will disappear once that computer in unplugged [takes a while].

This is what is happening. Could be your admins are bringing laps online or whatever. All it takes is someone to obtain an IP address.This can also happen if you have a wireless access point. Your DNS may be set up to discard or scavage all outdated dns records so that is why they don't show up. You can check your log files in system root.
Reject me again (I get hurt easily haha)

Not "too" upset I got rejected again. Happens a lot here. You may never get an absolute black and white answer. This is "IT". You can narrow the rogue computers a bit more . Are you using child domains? etc. They should show up in the appropriate subnent (or subdomain).
Again... one of the obvious things that pop out to me is: someone is bringing on a "laptop"..not on your network.(this again can be no problem... they may be just joining them to the domain.)))) If you have that many sites and users, check to see if they have brought any new laptoops online. That's my bet.
Well, I am finished here.
merv

I do get upset when your prematurely reject an answer. When you have a complex situation we can use the comments to arrive at a solution.

Now, back to your problem. I arrived at this question from the "show all questions" screen and don't know what catagory it originally appeared in. So again I ask, what operating systems are involved? Please, include service pack numbers. Do you use domains from w2k machines, workgroups only, or ADS? I don't know about the other people answering, but I can't read minds, and I really don't see enough information to be able do more than waste a lot of time going back and forth with vague possibilities hoping to randomly hit the problem. Please post a detailed description of your situation so that we can go right to the problem (there are many possibilities and only 2000 chars ;)

Also let us know if you use any type of VPN to connect the three sites. What brand?

Anyway, it appears that you may be using dynamic IP addressing DHCP. This is most likely why the portable computer can get an IP. DHCP is not very secure as it gives an IP to anyone that requests it. There are ways to filter for the hardware MACs and that way restrict DHCP leases to "authorized" users.

If, as you say, your security is advanced then the foriegn computer should not have access to the network since it does not log into any domain (if it did then you wouldn't see the rogue workgroup). Even with looser security you should be able to determine the name of the user in your domain from the logs.

The more clues you give, the we can help...

3 locations connected via CISCO PIX VPN.
ADS used with single domain.
Dynamic DHCP is used to dole out IPs. Static is not feasible.
Most likely problem is that someone is plugging an unauthorized laptop in to the network at an available outlet at one of the locations.

based upon everyones suggestions and I like Albert's last answer/suggestion that Naw! we don't get upset at rejected answers. Oscar Meyer to that! There is not one black and white correct answer to complex problems. Arriving at a solution can be accomplished by different routes each one providing a solution.

Your security event logs should show you unauthorized intrusion from WITHIN. Events like 644,645, user account lockout and computer account created will tell you alot about whats going on e.g. someone tried to get in and failed someone created a computer account [ which means someone plugged in and could access the the network and create a computer account [admin?]. If you've got 3 sites, each of which has a local DC with local domain users use to authenticate with, have each site use email to send your a daily server status report along with a secuirty log, directory services log, then you can look over the reports. In those will be domain name, user name, caller name and machine name, and target account.

Sounds like someone may have plugged into your network. One step in securtiy is the physical security. Having a map of your ports in the building and knowing where they are can be crucial. Our ports at work at labeled A1 through A24 and we have a map of where the corrisponding ports are on the patch panel with the room they are in. If someone is on your network go around the building and look to see if someone plugged into one of your ports. If you find a computer in the workgroup you could try to get into that computer by going to another computer on the network and typing in the computer name. For instance you see in network neighborhood the workgoup name and then the compter name XYZ so open up a browser and typ in \\XYZ\C$

This will bring you to the hidden share on to that computer. If you can get into that computer you will be able to see there files and maybe deduct who's computer it is.