Re: SBS 2003 Server.. Outside/internet users obtaining DHCP lease?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

On Apr 5, 7:35 pm, "Bill Sanderson" <bill_sander...@xxxxxxxxxxxxxxxxx>
wrote:
I'm trying to understand your evidence:  How do you get "canada" from a
machine name and a mac address?

I would look at the security logs as well.

"antari6675" <stevem6...@xxxxxxxxx> wrote in message

news:e11f7405-8264-4aec-a193-6d2e868bb92f@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Apr 5, 6:54 pm, "kj [SBS MVP]" <KevinJ....@xxxxxxxxxxxxxxxxxx>
wrote:





antari6675 wrote:
Hi,

Ive been running our sbs 2003 server for a year now and in the last 3
days Ive noticed that someone from outsite our network is obtaining a
DHCP lease on our server. He's not looking at files, his user id is
not created , nor is his client computer. He simply is grabbing a IP
addy thru the DHCP and using our internet connection as a proxy?

Question is.. How can this happen?

Unauthorized wired or wireless connection, or perhaps even VPN. VPN is
easier to determine from logs.

Somebody just plugging in is a little harder. Have you has any 'visitors'
to
your site who may have brought their laptop with them?

Thank you in advance

Antari6675

--
/kj

No wireless capabilies on the network.

We are located in Michigan.. and of the two that connected, one was in
Canada.
The only way I detected the lease was in the DHCP addressleases.

10.10.10.x     namexxxxx   4/10/2008   and a mac addy.

It was over the internet for sure. We are a small company, and I have
the ability to check all plug in connection.

I will have to check the VPN logs. I am by no means an expert at sbs
2003.- Hide quoted text -

- Show quoted text -

My appologies...

The name of the client computer had a company url addy in it, and I
traced that to canada.

Like I said, im not very clear on all this.. But where exactly would
these logs be? I have been looking at all the logs that I can find,
and cant find any instance of the occurance. I have a feeling im not
looking at the right ones.
.

Relevant Pages

  • Re: Client drops network connection repeatedly
    ... Now how about the network patch cable from the PC ... check the logs on your ... accessing the network do) The DHCP log for the DHCP server that it leases ... the address from shows a pattern of repeated renewals of the lease before ...
    (microsoft.public.windows.server.networking)
  • Re: DHCP Problem
    ... Select the Internal network, and edit it to include .255 ... Server the week before. ... Denied Connections started showing up in the ISA logs seconds later. ... Ethernet adapter Server Local Area Connection: ...
    (microsoft.public.backoffice.smallbiz)
  • Client drops network connection repeatedly
    ... I have a PC client on our WS2003 network that often drops its connection and crashes. ... The DHCP log for the DHCP server that it leases the address from shows a pattern of repeated renewals of the lease before it should have expired. ... If the computer is restarted then the event logs cease and as we can see a new DHCP lease is issued at that time. ...
    (microsoft.public.windows.server.networking)
  • Re: Networking and File Sharing....
    ... What do you mean by "logs". ... >>> network with a desktop computer and a laptop computer. ... >>> broadband internet via wireless connection. ...
    (microsoft.public.windowsxp.network_web)
  • Re: DHCP Problem
    ... Server the week before. ... Denied Connections started showing up in the ISA logs seconds later. ... or 255.255.255.255 relating to DHCP. ... Ethernet adapter Server Local Area Connection: ...
    (microsoft.public.backoffice.smallbiz)