Please click the link below for your operating system to download the TSG SysInfo Utility. Click on "Save File" then double-click the file to run it. Copy and paste the report in your initial post. Windows 7 and later (downloads a file named tsginfo.exe) | Windows XP (downloads a file named SysInfo.exe)

Win2k DHCP server giving out IP add. to unauthorized PCs

770 Views 3 Replies 3 Participants Last post by JohnWill, Dec 21, 2002

PB1856

Discussion Starter · Dec 20, 2002

Good afternoon everyone,
A fellow sys admin has come to me with a question and I didn't have an answer for him, so thought I would turn to you guys. He has a Win2k domain with DHCP set up. Everything is working and if you look up in the DHCP Leases, you will see all computers in his domain listed along with their FQDN. However, he noticed the other day that there was a PC listed as receiving a IP address lease that was not part of his domain. The computer's name appeared on the DHCP list, but just as computername followed by a ".", where all the others were listed as their FQDN's. So I am assuming what is going on is that someone connected a laptop to the subnet and it is trying and succeeded in getting an IP from the DHCP server. But due to security policies and rights, they were not able to join and be part of the domain.

But his concern is that a rogue laptop was able to get an IP address. So my question is, what sort of security risk was this and how can this be prevented or can it be?

Thank you!

Save

Status: Not open for further replies.

1 - 4 of 4 Posts

Rockn

· #2 · Dec 20, 2002

Have him make sure there are no trojans or ports open that would allow this kind of entry in the first place. If they have connected to the network they aren't that far away from finding a back dorr or something else left open. Do they by chance have any wireless access points or other wireless networking going on? Might be someone war driving if this is the case.

Save

PB1856

Discussion Starter · #3 · Dec 20, 2002

No wireless

Save

JohnWill

· #4 · Dec 21, 2002

I'm not sitting in front of it right now, but there is a way to restrict the DHCP server to handing out only specific MAC addresses, which should stop the casual connection.

Save

1 - 4 of 4 Posts

Status: Not open for further replies.

Top Contributors this Month