Network settings change

I have a small network, consisting of a server (running linux, configured as firewall, router/internet gateway and dns server), and two client workstations running Windows 2000.

In this lan, the two windows systems are configured with static IP addresses. This setup generally works fine, the windows machines communicate with each other and with the internet via my server.

However, lately it happens quite often that the network settings on both windows machines are changed to "Obtain an IP address automatically" instead of my static settings. I have no idea why this happens.

All I can do then is to open the TCP/IP properties and reconfigure the settings after which the computer asks me to reboot. This also seems weird to me. Before I could change these settings without having to reboot.

For further information, I have copied the output of ipconfig/all in good and bad condition of one of the systems:

Good
-----
Windows 2000 IP Configuration



Host Name . . . . . . . . . . . . : lappie
Primary DNS Suffix . . . . . . . : goudsmid.be
Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : vialila.be

Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet Adapter (10/100)
Physical Address. . . . . . .In this lan, the two windows systems are configured with static IP addresses. This setup generally works fine, the windows machines communicate with each other and with the internet via my server.

However, lately it happens quite often that the network settings on both windows machines are changed to "Obtain an IP address automatically" instead of my static settings. I have no idea why this happens.

All I can do then is to open the TCP/IP properties and reconfigure the settings after which the computer asks me to reboot. This also seems weird to me. Before I could change these settings without having to reboot.

For further information, I have copied the output of ipconfig/all in good and bad condition of one of the systems:

Good
-----
Windows 2000 IP Configuration



Host Name . . . . . . . . . . . . : lappie
Primary DNS Suffix . . . . . . . : goudsmid.be
Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : vialila.be

Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet Adapter (10/100)
Physical Address. . . . . . . . . : 00-20-E0-66-6E-C3

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.3

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1
195.130.132.18


Bad
---
Windows 2000 IP Configuration



Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : vialila.be

Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet Adapter (10/100)
Physical Address. . . . . . . . . : 00-20-E0-66-6E-C3

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.3

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1
195.130.132.18


The only change I see, is that the hostname and primary domain suffix are mi . . : 00-20-E0-66-6E-C3

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.3

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1
195.130.132.18


Bad
---
Windows 2000 IP Configuration



Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : vialila.be

Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet Adapter (10/100)
Physical Address. . . . . . . . . : 00-20-E0-66-6E-C3

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.3

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1
195.130.132.18


The only change I see, is that the hostname and primary domain suffix are missing. If I look at the network information tab of My Computer's properties when the network has gone bad, the computer name is set to unknown.*unknown*. If I try to change this, I get an error message that "Insufficient resources are available to make the change ".

All I can do is go to the TCP/IP settings, change the IP back to static and reboot. After that reboot, all is ok again, including computer name.


What could be going on here ?

 

Sorry for the garbled message

This is my first post, and for some reason the text is a bit garbled. I previewed my message though until it looked good, but apparently, I am doing something wrong.

Sorry about that. So if someone could also explain to me how to avoid this weird message composition, I'd be very thankful.

 

Hi gjanssens and welcome. The garbling was a problem with the forum software. We've only been running this version for a couple of days and there are some glitches. The one that caused your post to trash has been fixed - we think.

At a guess, you have a damaged network load. Since both your 2K machines have the same one, I'd again guess at some sort of damage from spyware/malware or similar or else possibly a new piece of badly-behaving software that you loaded on both.

There is a fix-it utility that often helps with this sort of thing on XP but I don't know that it would be safe to run on 2K.

Best I can suggest is
- run several good spyware cleaners (ad-aware, spybot, sypwareblaster are all good but be sure to update them after install and before running them).
- run sfc /scannow from either start~run or from a cmd prompt

If that doesn't help, try
- removing all networking devices from device manager
- shutting down and physically removing them
- starting up and then shutting down again
- replacing the NIC and letting the system load things again.

 

Maybe solved

Hi Newt,

Thanks for the reply.

I run adaware on both machines regularly already. I'll see into the others you mention as well.

I have been dealing with a number of open issues on the linux machine this weekend and I suspect that one of them might have been causing this weird behavior.

The DNS server was misconfigured, which resulted in rather strange address translations. The DNS server indicated another domain then the two 2k boxes. Maybe this conflict led the 2k machines to reset their network information. This has been set straight now.

I'll have to wait a couple of days to see if the problem is solved or not. I'll report back anyway to confirm this or to ask further questions.

Geert

 

Thanks for the update. Hope it's cured.

 

Alas, no luck

Alas,

my assumption was wrong

The network settings still get changed.

I have run sfc /scannow
I have installed and updated Ad-aware, Spybot S&D and Spywareblaster.
Still after that, the settings change.

What can I do now ?

Also, a question on sfc. I read this checks if no core files are modified. It requires the installation disk for that. But my installation disk is SP1, the other updates I have done via the Windows Update website. Since sfc verifies based on SP1 in my case, will it overwrite the updates from the different service packs then ? If so, how should I deal with that ?


Thanks already for helping me out here.

Geert

 

SFC is supposed to be smart enough in it's latest version to notice which files are updates and to leave them alone.

Did you try removing the NICs and all traces of the current network software and starting the network setup over again so it would be certain to be clean?

 

Two NICS and a Switch indeed

No, neither have. But if I change the setting back to a fixed IP, and reboot the win2K machine, the internet connection is stored. I don't have to reboot the linux box, nor the switch at that time. Note that even when the win2k machines can't access the net, the linux box still can.

How do you conclude that the second NIC could be failing ? I am curious, as I don't see the link here.

No the dhcp server is running, but it is configured for another subnet (with macs).

I'm not sure if this matters anyway, because the dhcp client on the win2k boxes is completely disabled.


Thanks for trying to help.

Geert