WINS Issue

[MrHawkins]

Afternoon all,

Right this is proving to be a real pain .... here goes!

We have 2 servers that build up our Active Directory using Windows 2003 that's all up to date; they both act as our WINS servers and are configured to look at themselves only (as you should) for WINS resolution.

When the one of the servers was installed it was given 2 ip's (don't ask why), one being 192.168.0.70 and one being 192.168.0.30; after the install settled down the 0.30 address was removed from SERVER1 and we continued to develop our AD.

We found people had problems running login scripts etc and in trying to solve this found our WINS dbase still had this 0.30 address in it.

My problem is no matter what I do the address keeps coming back for SERVER1 and it doesn't exist on the network!!

So far I've tried ...

1.Straight deleted the entries on both WINS servers
2.Delete both WINS dbase and starting again
3.Remove all the network cards from the 2 WINS servers and reinstall them with fresh WINS dbases

Obviously I've checked that 0.30 doesn't exist anywhere, yet the WINS dbase starts off with the correct 0.70 entry for SERVER1 when a fresh dbase is created, then slowly the 0.30 entry populates over the top!

- There's no DHCP reservations for this IP
- There's no DNS entry
- The IP Physically doesn't exist
- WINS is only running on these two servers

I'm at a loss at to what else I can do !!

Dave.

 

[ShackDaddy]

MrHawkins, the one thing I notice that you haven't done is search the registry for that address. I know that IP addresses are stored in several places there.

Specifically look in HKLM\System\CurrentControlSet\Services and look near the top of the services list for some weird entries that start with bracket signs -- { --. Inside those you will find a 'parameters' key and within that, some IP address listings. It may be there that you need to change something, or maybe the Find feature will turn something up somewhere else.

That's the only place I can think of that the 0.30 address might have been hiding out.

ShackDaddy

 

[david902]

search the server registries for 192.168.0.30
they might be in there.

I've seen MS do dome funky stuff.

if it's not such a big deal, bind the 192.168.0.30 IP back to the servers NIC, document it, and leave it there.

 

[GlenJohnson]

If you're server is running 2003, and you have ad running, why are you running wins? Do you have pre w2k machines on the network? Wins is going to be gone one of these days. All os's starting with w2k, then xp don't need wins at all. They use only dns. Just curious. Thanks and good luck.

Glen A. Johnson
Johnson Computer Consulting
If you're from Northern Il, Southern Wi, feel free to join Tek-Tips in Chicago IL

 

[ShackDaddy]

It would be nice to live in a world without WINS...but the need for it keeps being inserted from surprising directions. Like all versions of Exchange, for one....

See the article titled: Exchange Server 2003 and Exchange 2000 Server require NetBIOS name resolution for full functionality

http://support.microsoft.com/?id=837391

ShackDaddy

 

[MrHawkins]

Cheers for the replies - as for why we're still running WINS it's because we still have about 20 old 98SE machines on the network that have yet to be replaced with XP machines - dam budgets for you !!

As for checking the registry, I forgot to mention I've checked that too! The 0.30 IP could be found in the DHCP address, I did change it and the NIC is manually configured. Just to be sure I checked again yesterday - it had crept back in !

Any other suggestions ??

 

[MrHawkins]

Another thing to add - if I stop and restart the WINS service on the server that should have 0.70 and changes to 0.30 in it's own WINS dbase all the records start off correctly (as I said before).

I've noticed it's the "--__MSBROWSE__-" record that always changes first? I'm not sure if that's to be expected but thought I'd post it up anyway.

Dave

 

[ShackDaddy]

You sure you don't have any bad entries in your LMHOSTS file?

And go to the command line on each of your WINS servers and do an 'nbtstat -c' and see if that IP shows up. If so, paste the line (including TTL and everything) that it is mentioned on into your next post, and we'll see if we can't figure out where it came from.

Lastly, when that bad entry shows up in the WINS database, what's the rest of the data associate with the entry? State, owner ID, timestamp...

ShackDaddy

 

[MrHawkins]

Cheers for that last post ShackDaddy - that's given me another angle!

Our exchange server had the 0.30 in the NetBios Cache, i've cleared it out and check all the other servers too. I suppose that server could have been writing back to the WINS dbase?

I'll keep you posted on whether that's sorted the problem ...

Cheers Guys !!

 

[ShackDaddy]

Dave, it has to get into your cache from somewhere, usually your lmhosts file, and by noting whether there is a Time-to-live (TTL) on the specific entry in the cache, you can tell whether it's a static entry or whether it got into the cache some other way.

No matter what, purging the cache won't do the trick here; the entry there had to originate someplace else. There's no way to create entries in the cache right at the cache.

ShackDaddy

 

[MrHawkins]

Yeah I found this out too - turns out there was a dodgy looking RAS connection using this IP on one of the AD Servers that 'someone' had setup without documenting - Who'd work in IT eh?

Thanks again for all your help ...