SP4 kills DNS?

Archived from groups: microsoft.public.win2000.dns (More info?)

After upgrading a workstation with SP4, DNS stopped working.

I have two machines next to each other. Using nslookup works on one but
not the other. Both have the same DNS entry (my firewall).

The one that fails says:
*** Can't find server name for address x.x.x.x: No response from server
*** Default servers are not available
Server: Unknown
Address: x.x.x.x

If I lookup the address and type it into the browser (like
64.233.187.104 for google) it works just fine.


The problem impacts browsing, email, news.

There are entries in the event viewer:
Source: Dnscache
Event 11050
"The DNS Client could not contat any DNS servers for a repeated number
of attempts." etc.

The warning appears for the first time just after the NTServicePack entry.

Bob
18 answers Last reply
More about kills
  1. Archived from groups: microsoft.public.win2000.dns (More info?)

    "bob" <not@not.not> wrote in message
    news:6fJUd.37494$Rl5.9698@bignews4.bellsouth.net...
    > After upgrading a workstation with SP4, DNS stopped working.

    Probably NOT due to the upgrade.

    > I have two machines next to each other. Using nslookup works on one but
    > not the other. Both have the same DNS entry (my firewall).
    >
    > The one that fails says:
    > *** Can't find server name for address x.x.x.x: No response from server
    > *** Default servers are not available
    > Server: Unknown
    > Address: x.x.x.x

    The above is a BOGUS error from NSLookup and
    can be safely ignored (failure to REVERSE the DNS
    server name is ok as long as you get the answer to the
    REAL question your asked.)

    > If I lookup the address and type it into the browser (like
    > 64.233.187.104 for google) it works just fine.

    Then likely one the real answer is working even
    in NSLookup.

    When a resolution works but DNS is failing it
    CAN resolve the name through other methods
    (Hosts file, WINS/broadcasts using NetBIOS)
    but these other methods are generally only
    effective at resolving INTERNAL names (Not
    those like Google which are only on the Internet.)

    > The problem impacts browsing, email, news.
    >
    > There are entries in the event viewer:
    > Source: Dnscache
    > Event 11050
    > "The DNS Client could not contat any DNS servers for a repeated number
    > of attempts." etc.
    >
    > The warning appears for the first time just after the NTServicePack entry.

    Show us your "IPConfig /all" output by dumping
    it to a file (NOT by typing it in) and tell us about
    any internal DNS servers you have.

    Internal machines should be set STRICTLY to
    internal DNS servers IF any exist. Internal DNS
    servers should generally forward to the ISP (or
    firewall/router/DMZ) DNS server.
  2. Archived from groups: microsoft.public.win2000.dns (More info?)

    Herb Martin wrote:
    > "bob" <not@not.not> wrote in message
    > news:6fJUd.37494$Rl5.9698@bignews4.bellsouth.net...
    >
    >>After upgrading a workstation with SP4, DNS stopped working.
    >
    >
    > Probably NOT due to the upgrade.

    It doesn't make much sense that it would be, but I made no other
    changes, and it doesn't seem likely that it would just spontaneously
    quit working, either...

    >
    > Show us your "IPConfig /all" output by dumping
    > it to a file (NOT by typing it in) and tell us about
    > any internal DNS servers you have.

    >>>>>>>>


    Windows 2000 IP Configuration


    Host Name . . . . . . . . . . . . : bob
    Primary DNS Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Broadcast

    IP Routing Enabled. . . . . . . . : No

    WINS Proxy Enabled. . . . . . . . : No


    Ethernet adapter Local Area Connection:


    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : 3Com EtherLink 10/100 PCI For
    Complete PC Management NIC (3C905C-TX)
    Physical Address. . . . . . . . . : 00-50-DA-21-79-23

    DHCP Enabled. . . . . . . . . . . : No

    IP Address. . . . . . . . . . . . : 192.168.0.5

    Subnet Mask . . . . . . . . . . . : 255.255.255.0

    Default Gateway . . . . . . . . . : 192.168.0.252

    DNS Servers . . . . . . . . . . . : 192.168.0.252

    <<<<<<<


    The DNS server is on 192.168.0.252. It's also the firewall so it serves
    as the gateway. It works fine for all the other computers on the
    network. The only real difference I see between these results and the
    results for other computers on the network ist that "Node Type" is
    "Broadcast" for this machine, whereas the others are "Hybrid." I do not
    know what "node type" is.

    Bob
  3. Archived from groups: microsoft.public.win2000.dns (More info?)

    "bob" <not@not.not> wrote in message news:Nr%Ud.544

    > The DNS server is on 192.168.0.252. It's also the firewall so it serves
    > as the gateway. It works fine for all the other computers on the
    > network.

    Firewall? What OS is the firewall?

    What exact errors or problems are you seeing?

    Do you have your own zones?
    (This does not seem to be an AD domain, correct?)

    > The only real difference I see between these results and the
    > results for other computers on the network ist that "Node Type" is
    > "Broadcast" for this machine, whereas the others are "Hybrid." I do not
    > know what "node type" is.

    NetBIOS resolution type -- it is B-node due to
    not haveing a WINS server configured. That
    your other machines are H-node implies you have
    a WINS server and so even though it is not part
    of this problem it should be fixed by telling this
    machine the address of the WINS server(s).

    Internal machines should be clients of STRICTLY
    internal DNS and WINS servers (if you have those
    services.)

    Although some of the following may not true for
    you if you have no AD you might wish to review it:

    DNS for AD
    1) Dynamic for the zone supporting AD
    2) All internal DNS clients NIC\IP properties must specify SOLELY
    that internal, dynamic DNS server (set.)
    3) DCs and even DNS servers are DNS clients too -- see #2
    4) If you have more than one Domain, every DNS server must
    be able to resolve ALL domains (either directly or indirectly)

    netdiag /fix

    ....or maybe:

    dcdiag /fix

    (Win2003 can do this from Support tools):
    nltest /dsregdns /server:DC-ServerNameGoesHere
    http://support.microsoft.com/kb/q260371/

    Ensure that DNS zones/domains are fully replicated to all DNS
    servers for that (internal) zone/domain.

    Also useful may be running DCDiag on each DC, sending the
    output to a text file, and searching for FAIL, ERROR, WARN.

    Single Label domain zone names are a problem Google:
    [ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

    --
    Herb Martin


    "bob" <not@not.not> wrote in message
    news:Nr%Ud.544$w85.22@bignews3.bellsouth.net...
    > Herb Martin wrote:
    > > "bob" <not@not.not> wrote in message
    > > news:6fJUd.37494$Rl5.9698@bignews4.bellsouth.net...
    > >
    > >>After upgrading a workstation with SP4, DNS stopped working.
    > >
    > >
    > > Probably NOT due to the upgrade.
    >
    > It doesn't make much sense that it would be, but I made no other
    > changes, and it doesn't seem likely that it would just spontaneously
    > quit working, either...
    >
    > >
    > > Show us your "IPConfig /all" output by dumping
    > > it to a file (NOT by typing it in) and tell us about
    > > any internal DNS servers you have.
    >
    > >>>>>>>>
    >
    >
    > Windows 2000 IP Configuration
    >
    >
    >
    > Host Name . . . . . . . . . . . . : bob
    > Primary DNS Suffix . . . . . . . :
    > Node Type . . . . . . . . . . . . : Broadcast
    >
    > IP Routing Enabled. . . . . . . . : No
    >
    > WINS Proxy Enabled. . . . . . . . : No
    >
    >
    > Ethernet adapter Local Area Connection:
    >
    >
    >
    > Connection-specific DNS Suffix . :
    > Description . . . . . . . . . . . : 3Com EtherLink 10/100 PCI For
    > Complete PC Management NIC (3C905C-TX)
    > Physical Address. . . . . . . . . : 00-50-DA-21-79-23
    >
    > DHCP Enabled. . . . . . . . . . . : No
    >
    > IP Address. . . . . . . . . . . . : 192.168.0.5
    >
    > Subnet Mask . . . . . . . . . . . : 255.255.255.0
    >
    > Default Gateway . . . . . . . . . : 192.168.0.252
    >
    > DNS Servers . . . . . . . . . . . : 192.168.0.252
    >
    > <<<<<<<
    >
    >
    > The DNS server is on 192.168.0.252. It's also the firewall so it serves
    > as the gateway. It works fine for all the other computers on the
    > network. The only real difference I see between these results and the
    > results for other computers on the network ist that "Node Type" is
    > "Broadcast" for this machine, whereas the others are "Hybrid." I do not
    > know what "node type" is.
    >
    > Bob
  4. Archived from groups: microsoft.public.win2000.dns (More info?)

    Herb Martin wrote:
    > "bob" <not@not.not> wrote in message news:Nr%Ud.544
    >
    >
    >>The DNS server is on 192.168.0.252. It's also the firewall so it serves
    >>as the gateway. It works fine for all the other computers on the
    >>network.
    >
    >
    > Firewall? What OS is the firewall?

    Linux: IPcop. Since none of the other machines have a problem I don't
    think the firewall is the issue.

    >
    > What exact errors or problems are you seeing?

    That was in the first post. One, and only one PC on the network is not
    able to resolve names. If I launch internet explorer and type in a name
    (i.e. www.google.com) it doesn't go there. If I type in the IP address
    then it will go there. Similarly, the mail program is unable to connect
    to the named mail server and the news program can't connect to the named
    news server. The event viewer reports that "The DNS clinet service could
    not contact any DNS servers." I know the network connections are good
    because I can connect to the PC from any of the others and navigate the
    folders.


    > Do you have your own zones?
    > (This does not seem to be an AD domain, correct?)

    It's just 5 PCs and a printer plugged into a switch. The PCs are
    assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
    switch is plugged into the firewall. The firewall is plugged into the
    DSL router/modem.


    >
    > NetBIOS resolution type -- it is B-node due to
    > not haveing a WINS server configured. That
    > your other machines are H-node implies you have
    > a WINS server and so even though it is not part
    > of this problem it should be fixed by telling this
    > machine the address of the WINS server(s).

    There is no WINS server. On the WINS tab of the Advanced TCP/IP
    settings, all the machines have no values in the WINS addresses box.
    They all have the Enable LMHOSTS lookup checked, and the Enable NetBIOS
    over TCP/IP radio button selected.

    Bob
  5. Archived from groups: microsoft.public.win2000.dns (More info?)

    > >>The DNS server is on 192.168.0.252. It's also the firewall so it serves
    > >>as the gateway. It works fine for all the other computers on the
    > >>network.

    Show the IPConfig /all for at a working machine.
    (for comparison)

    > > Firewall? What OS is the firewall?
    >
    > Linux: IPcop. Since none of the other machines have a problem I don't
    > think the firewall is the issue.
    > >
    > > What exact errors or problems are you seeing?
    >
    > That was in the first post. One, and only one PC on the network is not
    > able to resolve names. If I launch internet explorer and type in a name
    > (i.e. www.google.com) it doesn't go there. If I type in the IP address
    > then it will go there. Similarly, the mail program is unable to connect
    > to the named mail server and the news program can't connect to the named
    > news server. The event viewer reports that "The DNS clinet service could
    > not contact any DNS servers." I know the network connections are good
    > because I can connect to the PC from any of the others and navigate the
    > folders.

    What happens when you perform NSlookup (from
    the client directly)?

    nslookup www.google.com

    ....and...

    nslookup www.google.com

    (past results from both)

    What firewalls are you running on this machine?
    (Norton, etc?)


    > It's just 5 PCs and a printer plugged into a switch. The PCs are
    > assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
    > switch is plugged into the firewall. The firewall is plugged into the
    > DSL router/modem.

    Were the above true that would be your problem
    (192.160.0.x is NOT your range) but it is likely
    a type.

    IP Address. . . . . . . . . . . . : 192.168.0.5
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 192.168.0.252
    DNS Servers . . . . . . . . . . . : 192.168.0.252


    > > NetBIOS resolution type -- it is B-node due to
    > > not haveing a WINS server configured. That
    > > your other machines are H-node implies you have
    > > a WINS server and so even though it is not part
    > > of this problem it should be fixed by telling this
    > > machine the address of the WINS server(s).
    >
    > There is no WINS server. On the WINS tab of the Advanced TCP/IP
    > settings, all the machines have no values in the WINS addresses box.

    Then the other machines are NOT "H-node" as
    you claimed in the previous post.

    H-node only applies to a WINS client (or perhaps
    to a machine which is receiving an incorrect node
    type from the DHCP server which is unlikely with
    a Linux server.)

    > They all have the Enable LMHOSTS lookup checked, and the Enable NetBIOS
    > over TCP/IP radio button selected.

    With one subnet and so few machines there is no reason
    for LMHosts (nor WINS server) and you likely don't
    have the file containing any useful values anyway.

    None of this (NetBIOS) is relevant to Internet name
    resolution -- only to your own network -- and is even
    unnecessary for NetBIOS on a single subnet (i.e.,
    a single broadcast domain.)
  6. Archived from groups: microsoft.public.win2000.dns (More info?)

    Herb Martin wrote:

    > Show the IPConfig /all for at a working machine.
    > (for comparison)

    >>>>>>>>>>>>

    Windows 2000 IP Configuration


    Host Name . . . . . . . . . . . . : LEO
    Primary DNS Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No


    Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
    Physical Address. . . . . . . . . : 00-08-74-B4-35-95
    DHCP Enabled. . . . . . . . . . . : No
    IP Address. . . . . . . . . . . . : 192.168.0.12
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 192.168.0.252
    DNS Servers . . . . . . . . . . . : 192.168.0.252

    > What happens when you perform NSlookup (from
    > the client directly)?
    >
    > nslookup www.google.com
    >
    > ...and...
    >
    > nslookup www.google.com
    >
    > (past results from both)

    I don't see any difference between these commands. I posted the results
    two posts ago, but I did it again:

    *** Can't find server name for address 192.168.0.252: No response from
    server
    *** Default servers are not available
    Server: Unknown
    Address: 192.168.0.252
    *** UnKnown can't find www.google.com: No response from server

    The lines with *** don't redirect, so I had to type them in.

    >
    > What firewalls are you running on this machine?
    > (Norton, etc?)

    No software firewall. Norton AV 2002 is installed, and has been since 2002.

    >
    >>It's just 5 PCs and a printer plugged into a switch. The PCs are
    >>assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
    >>switch is plugged into the firewall. The firewall is plugged into the
    >>DSL router/modem.
    >
    >
    > Were the above true that would be your problem
    > (192.160.0.x is NOT your range) but it is likely
    > a type.
    >
    > IP Address. . . . . . . . . . . . : 192.168.0.5
    > Subnet Mask . . . . . . . . . . . : 255.255.255.0
    > Default Gateway . . . . . . . . . : 192.168.0.252
    > DNS Servers . . . . . . . . . . . : 192.168.0.252
    >

    Yes, a typo = 192.168.0.x, not 192.160.0.x

    Everything has been working fine with this machine for years -- it
    suddenly started acting the way it is just the other day.

    > Then the other machines are NOT "H-node" as
    > you claimed in the previous post.
    >
    > H-node only applies to a WINS client (or perhaps
    > to a machine which is receiving an incorrect node
    > type from the DHCP server which is unlikely with
    > a Linux server.)

    For some reason the output from ipconfig /all reports "Hybrid" on this
    machine. Three of the others are also hybrid, while the final machine is
    broadcast. DHCP is not enabled on the Linux box.


    >>They all have the Enable LMHOSTS lookup checked, and the Enable NetBIOS
    >>over TCP/IP radio button selected.
    >
    >
    > With one subnet and so few machines there is no reason
    > for LMHosts (nor WINS server) and you likely don't
    > have the file containing any useful values anyway.

    I assume that it's the default value, because I didn't set it.

    > None of this (NetBIOS) is relevant to Internet name
    > resolution -- only to your own network -- and is even
    > unnecessary for NetBIOS on a single subnet (i.e.,
    > a single broadcast domain.)

    I have discovered another piece of information that might help:

    On the machine that can't seem to resolve names into IP addresses, I
    can't print. The printer is a standard netowrk printer. The printer
    works fine (I can print from the other machines), and I haven't changed
    any settings on the PC that now can't print.

    On the other hand, the PC with the problems is able to navigate to the
    other computers on the network by name -- for example if I click on
    network neighborhood, I can see the other machines and double click on
    them and open their shared folders.

    Bob
  7. Archived from groups: microsoft.public.win2000.dns (More info?)

    "bob" <not@not.not> wrote in message
    news:Ry4Vd.20431$Q47.10246@bignews5.bellsouth.net...
    > Herb Martin wrote:
    >
    > > Show the IPConfig /all for at a working machine.
    > > (for comparison)
    >
    > >>>>>>>>>>>>
    >
    > Windows 2000 IP Configuration
    >
    > Host Name . . . . . . . . . . . . : LEO
    > Primary DNS Suffix . . . . . . . :
    > Node Type . . . . . . . . . . . . : Hybrid
    > IP Routing Enabled. . . . . . . . : No
    > WINS Proxy Enabled. . . . . . . . : No
    >
    >
    > Ethernet adapter Local Area Connection:
    >
    > Connection-specific DNS Suffix . :
    > Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
    Connection
    > Physical Address. . . . . . . . . : 00-08-74-B4-35-95
    > DHCP Enabled. . . . . . . . . . . : No
    > IP Address. . . . . . . . . . . . : 192.168.0.12
    > Subnet Mask . . . . . . . . . . . : 255.255.255.0
    > Default Gateway . . . . . . . . . : 192.168.0.252
    > DNS Servers . . . . . . . . . . . : 192.168.0.252

    Ok, the working machine (above here) uses the
    same DNS server as the failing machine.

    > > What happens when you perform NSlookup (from
    > > the client directly)?
    > > nslookup www.google.com
    > > ...and...
    > > nslookup www.google.com
    > > (past results from both)
    >
    > I don't see any difference between these commands.

    Sorry. I left off the address for some (silly reason).

    Second one should have been:

    nslookup www.google.com 192.168.0.252

    ....but it isn't likely to be different.

    > I posted the results two posts ago, but I did it again:
    That post snippet was confused and looked like it might
    be incomplete (due to editing.)

    > Can't find server name for address 192.168.0.252: No response from
    > server
    > Default servers are not available
    > Server: Unknown
    > Address: 192.168.0.252
    Everything above for NSLookup is irrelevent
    except that it confirms we are using the same
    DNS server ("Can't find name..." is a bogus
    error from NSLookup's funky practices.)

    It's the following line that matters:
    > UnKnown can't find www.google.com: No response from server

    Ok it fails -- I should have given you this
    (following) line to try as the same time:

    That by the way LOOKS like your DNS server
    answered but couldn't resolve Google, not that
    your server failed to answer.

    > The lines with *** don't redirect, so I had to type them in.

    I removed those but you can just COPY them from the screen
    with the select AND paste them in.

    So let's try this:

    nslookup -time=20 www.google.com 192.168.0.252

    (long timeout to make sure it isn't time sensitive)

    And this:

    nslookup www.learnquick.com 216.21.234.71

    (can't be yahoo because that server won't resolve
    just any zone for you.)

    If the latter works, then you station is resolving DNS
    and the problem is at the Linux router -- some kind
    of filter or something odd about it's DNS server.

    > > What firewalls are you running on this machine?
    > > (Norton, etc?)
    >
    > No software firewall. Norton AV 2002 is installed, and has been since
    2002.

    That would be my main suspect then.

    > >>It's just 5 PCs and a printer plugged into a switch. The PCs are
    > >>assigned ip addresses in the 192.160.0.x range. (No DHCP, No WINS). The
    > >>switch is plugged into the firewall. The firewall is plugged into the
    > >>DSL router/modem.
    > >
    > >
    > > Were the above true that would be your problem
    > > (192.160.0.x is NOT your range) but it is likely
    > > a type.
    > >
    > > IP Address. . . . . . . . . . . . : 192.168.0.5
    > > Subnet Mask . . . . . . . . . . . : 255.255.255.0
    > > Default Gateway . . . . . . . . . : 192.168.0.252
    > > DNS Servers . . . . . . . . . . . : 192.168.0.252
    > >
    >
    > Yes, a typo = 192.168.0.x, not 192.160.0.x
    >

    > For some reason the output from ipconfig /all reports "Hybrid" on this
    > machine. Three of the others are also hybrid, while the final machine is
    > broadcast. DHCP is not enabled on the Linux box.

    That's odd especially if you didn't leave out
    any lines (that's why I don't like for you to type
    them in--adds uncertainty) since it doesn't show
    a WINS server line.

    This implies someone has messed with the
    registry or the NICs have a WINS server listed
    but that it cannot be contacted (because it doesn't
    exist?)

    But again it is unrelated to your real problem unless
    it is an indication of these machines have been
    hacked (not necessarily in a bad way.)

    > I assume that it's the default value, because I didn't set it.

    Not unless there is a WINS server listed.


    > On the machine that can't seem to resolve names into IP addresses, I
    > can't print. The printer is a standard netowrk printer.

    There is no "standard" so that is meaningless but
    I presume you mean an IP printer attached directly
    to the network.

    And the "can't print" report is near meaningless
    unless you try to connect by name and IP and say
    precisely what the errors are.

    Can you ping the printer? (Always try ping by
    both name and IP and specify which works...)

    > The printer
    > works fine (I can print from the other machines), and I haven't changed
    > any settings on the PC that now can't print.
    >
    > On the other hand, the PC with the problems is able to navigate to the
    > other computers on the network by name -- for example if I click on
    > network neighborhood, I can see the other machines and double click on
    > them and open their shared folders.

    That is probably due to NetBIOS name resolution
    which in your case is broadcast based.

    If the Printer is not a "Windows" machine it would
    not respond to NetBIOS and so would only be available
    by IP and not by name since you have no internal DNS
    resolution (it appears.)
  8. Archived from groups: microsoft.public.win2000.dns (More info?)

    Herb Martin wrote:
    >
    > I removed those but you can just COPY them from the screen
    > with the select AND paste them in.

    I forgot about "copy" from the command prompt.

    >
    > So let's try this:
    >
    > nslookup -time=20 www.google.com 192.168.0.252
    >
    > (long timeout to make sure it isn't time sensitive)
    >
    > And this:
    >
    > nslookup www.learnquick.com 216.21.234.71
    >

    Here I have copied and pasted the commands and their results:

    >>>>>>>>>>>
    E:\>nslookup -time=20 www.google.com 192.168.0.252
    *** Can't find server name for address 192.168.0.252: No response from
    server
    Server: UnKnown
    Address: 192.168.0.252

    *** UnKnown can't find www.google.com: No response from server

    E:\>nslookup www.learnquick.com 216.21.234.71
    *** Can't find server name for address 216.21.234.71: No response from
    server
    Server: UnKnown
    Address: 216.21.234.71

    *** UnKnown can't find www.learnquick.com: No response from server
    <<<<<<<<<<<<<<<<<

    The first command reported the server UnKnown message instantly. I
    changed the -time switch to 200 and the same thing happened (instant
    response).

    >>>What firewalls are you running on this machine?
    >>>(Norton, etc?)
    >>
    >>No software firewall. Norton AV 2002 is installed, and has been since
    >
    > 2002.
    >
    > That would be my main suspect then.

    Before I ran the above commnads, I uninstalled Norton AV and LiveUpdate.
    There are now no antivirus or firewall type programs installed on the
    machine.

    >
    >>For some reason the output from ipconfig /all reports "Hybrid" on this
    >>machine. Three of the others are also hybrid, while the final machine is
    >>broadcast. DHCP is not enabled on the Linux box.
    >
    >
    > That's odd especially if you didn't leave out
    > any lines (that's why I don't like for you to type
    > them in--adds uncertainty) since it doesn't show
    > a WINS server line.

    No I did not leave out any lines.

    > This implies someone has messed with the
    > registry or the NICs have a WINS server listed
    > but that it cannot be contacted (because it doesn't
    > exist?)
    >
    > But again it is unrelated to your real problem unless
    > it is an indication of these machines have been
    > hacked (not necessarily in a bad way.)

    That's curious. Several of the machines are occasionally used by a high
    school student, and he does things that I wish he did not, but I do not
    believe he has used the machine in question, nor one of the machines
    reporting "hybrid". Since those machines seem to be working properly and
    show no evidence of being compromised, I'm not going to worry about them
    right now.

    >
    >>On the machine that can't seem to resolve names into IP addresses, I
    >>can't print. The printer is a standard netowrk printer.
    >
    >
    > There is no "standard" so that is meaningless but
    > I presume you mean an IP printer attached directly
    > to the network.

    Yes, it is a HP printer with a jetdirect card. By "standard" I meant
    that the machine is configured with the built in (Win2k) TCP/IP printer
    services.

    > And the "can't print" report is near meaningless
    > unless you try to connect by name and IP and say
    > precisely what the errors are.
    >
    > Can you ping the printer? (Always try ping by
    > both name and IP and specify which works...)

    In the printers control panel, my printer is named "4650" the computer
    is named "bob"

    >>>>>>>>>>>>>>>
    E:\>ping 192.168.0.71

    Pinging 192.168.0.71 with 32 bytes of data:

    Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    Reply from 192.168.0.71: bytes=32 time<10ms TTL=64

    Ping statistics for 192.168.0.71:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

    E:\>ping \\bob\4650
    Unknown host \\bob\4650.

    <<<<<<<<<<<<<<<<<<<<<

    There is roughly a 2 second delay between pressing enter and getting the
    unknown host response.

    >
    > That is probably due to NetBIOS name resolution
    > which in your case is broadcast based.
    >
    > If the Printer is not a "Windows" machine it would
    > not respond to NetBIOS and so would only be available
    > by IP and not by name since you have no internal DNS
    > resolution (it appears.)

    I really appreciate all the help, and I feel like we must be narrowing
    in on the cause.

    Bob
  9. Archived from groups: microsoft.public.win2000.dns (More info?)

    In news:_blVd.21158$Q47.10089@bignews5.bellsouth.net,
    bob <not@not.not> commented
    Then Kevin replied below:

    > E:\>ping \\bob\4650
    > Unknown host \\bob\4650.

    DNS won't resolve host names on this box, it has no DNS suffix search list
    to send to a DNS server. This machine would require NetBIOS resolution to
    resolve host names.
    try this you'll see:
    nslookup -d2 bob

    Wihtout a DNS suffix search list, the DNS server doesn't know where to look
    for the host..

    I've seen this before and I'm searching my memory for what the problem was.
    IIRC, on the one before, the machine had ZoneAlarm on it that was removed
    but not fully removed. Did this box previously have ZoneAlarm on it?

    --
    Best regards,
    Kevin D4 Dad Goodknecht Sr. [MVP]
    Hope This Helps
    ===================================
    When responding to posts, please "Reply to Group"
    via your newsreader so that others may learn and
    benefit from your issue, to respond directly to
    me remove the nospam. from my email address.
    ===================================
    http://www.lonestaramerica.com/
    ===================================
    Use Outlook Express?... Get OE_Quotefix:
    It will strip signature out and more
    http://home.in.tum.de/~jain/software/oe-quotefix/
    ===================================
    Keep a back up of your OE settings and folders
    with OEBackup:
    http://www.oehelp.com/OEBackup/Default.aspx
    ===================================
  10. Archived from groups: microsoft.public.win2000.dns (More info?)

    "bob" <not@not.not> wrote in message
    news:_blVd.21158$Q47.10089@bignews5.bellsouth.net...
    > Herb Martin wrote:
    > I forgot about "copy" from the command prompt.
    > > nslookup -time=20 www.google.com 192.168.0.252
    > > nslookup www.learnquick.com 216.21.234.71

    > Here I have copied and pasted the commands and their results:
    > >>>>>>>>>>>
    > E:\>nslookup -time=20 www.google.com 192.168.0.252
    > *** UnKnown can't find www.google.com: No response from server

    Ok, it isn't time sensitive (even 10 seconds is enough.)

    > E:\>nslookup www.learnquick.com 216.21.234.71
    > *** UnKnown can't find www.learnquick.com: No response from server
    > <<<<<<<<<<<<<<<<<
    >
    > The first command reported the server UnKnown message instantly. I
    > changed the -time switch to 200 and the same thing happened (instant
    > response).

    I know for a fact that 2168.21.234.71 will answer
    DNS reliably. Something is blocking the request
    OR the response.

    The instant answer from the near DNS server seems
    to indicate that IT is causing the problem.

    > >>>What firewalls are you running on this machine?
    > >>>(Norton, etc?)
    > >>No software firewall. Norton AV 2002 is installed, and has been since
    > > 2002.

    Some versions of Norton include firewall
    software (all of which I consider to be junk
    but I think this is on the DNS-server/router

    > Before I ran the above commnads, I uninstalled Norton AV and LiveUpdate.
    > There are now no antivirus or firewall type programs installed on the
    > machine.

    Then this tends to put it more fully on
    the DNS server.

    > > But again it is unrelated to your real problem unless
    > > it is an indication of these machines have been
    > > hacked (not necessarily in a bad way.)
    >
    > That's curious. Several of the machines are occasionally used by a high
    > school student, and he does things that I wish he did not, but I do not
    > believe he has used the machine in question, nor one of the machines
    > reporting "hybrid". Since those machines seem to be working properly and
    > show no evidence of being compromised, I'm not going to worry about them
    > right now.

    That makes sense.

    > >>On the machine that can't seem to resolve names into IP addresses, I
    > >>can't print. The printer is a standard netowrk printer.
    > >
    > > There is no "standard" so that is meaningless but
    > > I presume you mean an IP printer attached directly
    > > to the network.
    >
    > Yes, it is a HP printer with a jetdirect card. By "standard" I meant
    > that the machine is configured with the built in (Win2k) TCP/IP printer
    > services.

    That's different than 'standard' <grin>

    > > And the "can't print" report is near meaningless
    > > unless you try to connect by name and IP and say
    > > precisely what the errors are.
    > >
    > > Can you ping the printer? (Always try ping by
    > > both name and IP and specify which works...)
    >
    > In the printers control panel, my printer is named "4650" the computer
    > is named "bob"

    [Which computer? ]

    I would be able to troubleshoot better if I
    knew you could/could-not connect by number
    and or name individually.

    > >>>>>>>>>>>>>>>
    > E:\>ping 192.168.0.71
    >
    > Pinging 192.168.0.71 with 32 bytes of data:
    >
    > Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    > Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    > Reply from 192.168.0.71: bytes=32 time<10ms TTL=64
    > Reply from 192.168.0.71: bytes=32 time<10ms TTL=64

    So the printer is "There" and reachable.

    > E:\>ping \\bob\4650
    > Unknown host \\bob\4650.

    Ping doesn't work that way.

    ping bob

    You really cannot have a "device" using
    a NUMBER for a name on an IP network.

    All names should begin with an alphabetic
    character, and have no more than a 13
    additional alphanumerics (per NetBIOS
    name and per label for DNS.)


    > I really appreciate all the help, and I feel like we must be narrowing
    > in on the cause.

    Let's talk about the DNS server...it's also a
    router, might there be filters etc on it....?
  11. Archived from groups: microsoft.public.win2000.dns (More info?)

    > DNS won't resolve host names on this box, it has no DNS suffix search list
    > to send to a DNS server. This machine would require NetBIOS resolution to
    > resolve host names.

    To resolve bare names -- it will
    resolve explicit names just fine.

    --
    Herb Martin


    "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message
    news:O#FeBm1HFHA.2620@tk2msftngp13.phx.gbl...
    > In news:_blVd.21158$Q47.10089@bignews5.bellsouth.net,
    > bob <not@not.not> commented
    > Then Kevin replied below:
    >
    > > E:\>ping \\bob\4650
    > > Unknown host \\bob\4650.
    >
    > DNS won't resolve host names on this box, it has no DNS suffix search list
    > to send to a DNS server. This machine would require NetBIOS resolution to
    > resolve host names.
    > try this you'll see:
    > nslookup -d2 bob
    >
    > Wihtout a DNS suffix search list, the DNS server doesn't know where to
    look
    > for the host..
    >
    > I've seen this before and I'm searching my memory for what the problem
    was.
    > IIRC, on the one before, the machine had ZoneAlarm on it that was removed
    > but not fully removed. Did this box previously have ZoneAlarm on it?
    >
    > --
    > Best regards,
    > Kevin D4 Dad Goodknecht Sr. [MVP]
    > Hope This Helps
    > ===================================
    > When responding to posts, please "Reply to Group"
    > via your newsreader so that others may learn and
    > benefit from your issue, to respond directly to
    > me remove the nospam. from my email address.
    > ===================================
    > http://www.lonestaramerica.com/
    > ===================================
    > Use Outlook Express?... Get OE_Quotefix:
    > It will strip signature out and more
    > http://home.in.tum.de/~jain/software/oe-quotefix/
    > ===================================
    > Keep a back up of your OE settings and folders
    > with OEBackup:
    > http://www.oehelp.com/OEBackup/Default.aspx
    > ===================================
    >
    >
  12. Archived from groups: microsoft.public.win2000.dns (More info?)

    Kevin D. Goodknecht Sr. [MVP] wrote:

    > try this you'll see:
    > nslookup -d2 bob

    >>>>>>>>>>>>>>>>>>>>>>>>
    E:\>nslookup -d2 bob
    ------------
    SendRequest(), len 44
    HEADER:
    opcode = QUERY, id = 1, rcode = NOERROR
    header flags: query, want recursion
    questions = 1, answers = 0, authority records = 0,
    additional = 0

    QUESTIONS:
    252.0.168.192.in-addr.arpa, type = PTR, class = IN

    ------------
    connect: No error
    SendRequest failed
    *** Can't find server name for address 192.168.0.252: No response from
    server
    *** Default servers are not available
    Server: UnKnown
    Address: 192.168.0.252

    ------------
    SendRequest(), len 21
    HEADER:
    opcode = QUERY, id = 2, rcode = NOERROR
    header flags: query, want recursion
    questions = 1, answers = 0, authority records = 0,
    additional = 0

    QUESTIONS:
    bob, type = A, class = IN

    ------------
    connect: No error
    SendRequest failed
    *** UnKnown can't find bob: No response from server

    <<<<<<<<<<<<<<<<


    > Wihtout a DNS suffix search list, the DNS server doesn't know where to look
    > for the host..
    >
    > I've seen this before and I'm searching my memory for what the problem was.
    > IIRC, on the one before, the machine had ZoneAlarm on it that was removed
    > but not fully removed. Did this box previously have ZoneAlarm on it?

    It did, but that was maybe 6 months or a year ago. It's been working
    fine since then. Just in case, I searched the registry and deleted all
    the keys with "zonelab", "zone alarm" and "zapro" in them. After
    rebooting the computer it still doesn't work.

    I read through this kb article on suffix serch lists, but it doesn't
    seem applicable. None of my other machines seem to have suffix search
    lists either.
    http://support.microsoft.com/default.aspx?scid=kb;en-us;162844

    Bob
  13. Archived from groups: microsoft.public.win2000.dns (More info?)

    In news:QKqVd.21687$Q47.9120@bignews5.bellsouth.net,
    bob <not@not.not> commented
    Then Kevin replied below:

    > It did, but that was maybe 6 months or a year ago. It's
    > been working fine since then. Just in case, I searched
    > the registry and deleted all the keys with "zonelab",
    > "zone alarm" and "zapro" in them. After rebooting the
    > computer it still doesn't work.

    It is not a registry entry, it is a loaded driver. I will see if I can find
    it.
    I know Ace used to have the directions, It has just been so long since the
    issue surfaced. But in that case, I think my memory says it didn't surface
    until SP4 was installed.

    Keep watching here, I'll find the fix. I don't think at that time it was on
    the Zone Labs website. But you might take a look there to see. But I can
    almost guarantee it is a ZoneAlarm issue, this is the third or fourth time
    in this group alone, that this has shown it ugly head on a machine that had
    ZoneAlarm removed.


    > I read through this kb article on suffix search lists, but
    > it doesn't seem applicable. None of my other machines
    > seem to have suffix search lists either.
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;162844


    You are correct this is not relevant, actually there is another reason why
    DNS can't resolve host names. You don't have or are not using a local DNS
    server. That tells me that you don't have an Active Directory domain, if you
    do, then your using the wrong DNS because it appears you're using your
    router for DNS.


    --
    Best regards,
    Kevin D4 Dad Goodknecht Sr. [MVP]
    Hope This Helps
    ===================================
    When responding to posts, please "Reply to Group"
    via your newsreader so that others may learn and
    benefit from your issue, to respond directly to
    me remove the nospam. from my email address.
    ===================================
    http://www.lonestaramerica.com/
    ===================================
    Use Outlook Express?... Get OE_Quotefix:
    It will strip signature out and more
    http://home.in.tum.de/~jain/software/oe-quotefix/
    ===================================
    Keep a back up of your OE settings and folders
    with OEBackup:
    http://www.oehelp.com/OEBackup/Default.aspx
    ===================================
  14. Archived from groups: microsoft.public.win2000.dns (More info?)

    "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message
    news:uJocYa4HFHA.2936@TK2MSFTNGP15.phx.gbl...
    > In news:QKqVd.21687$Q47.9120@bignews5.bellsouth.net,
    > bob <not@not.not> commented
    > Then Kevin replied below:
    >
    > > It did, but that was maybe 6 months or a year ago. It's
    > > been working fine since then. Just in case, I searched
    > > the registry and deleted all the keys with "zonelab",
    > > "zone alarm" and "zapro" in them. After rebooting the
    > > computer it still doesn't work.
    >
    > It is not a registry entry, it is a loaded driver. I will see if I can
    find
    > it.
    > I know Ace used to have the directions, It has just been so long since the
    > issue surfaced. But in that case, I think my memory says it didn't surface
    > until SP4 was installed.

    I had ZoneAlarm blowup a dual processor
    machine (not properly multi-threaded at least
    at one time) and the Service name I needed to
    stop in Recovery Console was NOT obvious.

    If you cannot find the name you might check
    their site for KB type articles related to multiprocessors
    or dual etc.

    (Not that this applies but it does list the name
    and that is where I found it -- buried way down
    in their support questions.)

    --
    Herb Martin


    "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message
    news:uJocYa4HFHA.2936@TK2MSFTNGP15.phx.gbl...
    > In news:QKqVd.21687$Q47.9120@bignews5.bellsouth.net,
    > bob <not@not.not> commented
    > Then Kevin replied below:
    >
    > > It did, but that was maybe 6 months or a year ago. It's
    > > been working fine since then. Just in case, I searched
    > > the registry and deleted all the keys with "zonelab",
    > > "zone alarm" and "zapro" in them. After rebooting the
    > > computer it still doesn't work.
    >
    > It is not a registry entry, it is a loaded driver. I will see if I can
    find
    > it.
    > I know Ace used to have the directions, It has just been so long since the
    > issue surfaced. But in that case, I think my memory says it didn't surface
    > until SP4 was installed.
    >
    > Keep watching here, I'll find the fix. I don't think at that time it was
    on
    > the Zone Labs website. But you might take a look there to see. But I can
    > almost guarantee it is a ZoneAlarm issue, this is the third or fourth time
    > in this group alone, that this has shown it ugly head on a machine that
    had
    > ZoneAlarm removed.
    >
    >
    > > I read through this kb article on suffix search lists, but
    > > it doesn't seem applicable. None of my other machines
    > > seem to have suffix search lists either.
    > > http://support.microsoft.com/default.aspx?scid=kb;en-us;162844
    >
    >
    > You are correct this is not relevant, actually there is another reason why
    > DNS can't resolve host names. You don't have or are not using a local DNS
    > server. That tells me that you don't have an Active Directory domain, if
    you
    > do, then your using the wrong DNS because it appears you're using your
    > router for DNS.
    >
    >
    > --
    > Best regards,
    > Kevin D4 Dad Goodknecht Sr. [MVP]
    > Hope This Helps
    > ===================================
    > When responding to posts, please "Reply to Group"
    > via your newsreader so that others may learn and
    > benefit from your issue, to respond directly to
    > me remove the nospam. from my email address.
    > ===================================
    > http://www.lonestaramerica.com/
    > ===================================
    > Use Outlook Express?... Get OE_Quotefix:
    > It will strip signature out and more
    > http://home.in.tum.de/~jain/software/oe-quotefix/
    > ===================================
    > Keep a back up of your OE settings and folders
    > with OEBackup:
    > http://www.oehelp.com/OEBackup/Default.aspx
    > ===================================
    >
    >
  15. Archived from groups: microsoft.public.win2000.dns (More info?)

    In news:QKqVd.21687$Q47.9120@bignews5.bellsouth.net,
    bob <not@not.not> commented
    Then Kevin replied below:
    >> I've seen this before and I'm searching my memory for
    >> what the problem was. IIRC, on the one before, the
    >> machine had ZoneAlarm on it that was removed but not
    >> fully removed. Did this box previously have ZoneAlarm on
    >> it?
    >
    > It did, but that was maybe 6 months or a year ago. It's
    > been working fine since then. Just in case, I searched
    > the registry and deleted all the keys with "zonelab",
    > "zone alarm" and "zapro" in them. After rebooting the
    > computer it still doesn't work.

    You're in luck, here are the instructions.

    http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html


    --
    Best regards,
    Kevin D4 Dad Goodknecht Sr. [MVP]
    Hope This Helps
    ===================================
    When responding to posts, please "Reply to Group"
    via your newsreader so that others may learn and
    benefit from your issue, to respond directly to
    me remove the nospam. from my email address.
    ===================================
    http://www.lonestaramerica.com/
    ===================================
    Use Outlook Express?... Get OE_Quotefix:
    It will strip signature out and more
    http://home.in.tum.de/~jain/software/oe-quotefix/
    ===================================
    Keep a back up of your OE settings and folders
    with OEBackup:
    http://www.oehelp.com/OEBackup/Default.aspx
    ===================================
  16. Archived from groups: microsoft.public.win2000.dns (More info?)

    Kevin D. Goodknecht Sr. [MVP] wrote:

    >
    > You're in luck, here are the instructions.
    >
    > http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html

    That was it!

    So my old version of Zone Alarm Pro had left something behind when I
    used the uninstall. Whatever that something was, it was not a problem
    until SP4 was installed.

    My computer is now browsing the internet, printing, and receiving email.

    Thank both of you very much.

    Bob
  17. Archived from groups: microsoft.public.win2000.dns (More info?)

    In news:iuHVd.36$5T6.28@bignews4.bellsouth.net,
    bob <not@not.not> commented
    Then Kevin replied below:
    > Kevin D. Goodknecht Sr. [MVP] wrote:
    >
    >>
    >> You're in luck, here are the instructions.
    >>
    >>
    http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html
    >
    > That was it!
    >
    > So my old version of Zone Alarm Pro had left something
    > behind when I used the uninstall. Whatever that something
    > was, it was not a problem until SP4 was installed.

    If I remember correctly, the last three exhibited the same behavior, no
    problem until SP4 was installed. When you first posted, I knew I had seen
    this before, none of the previous users had connected it to ZoneAlarm since
    ZoneAlarm was uninstalled long before SP4. The way it was discovered to be
    ZoneAlarm, the first user called Microsoft, they found it possibly by
    happenstance, then the original poster came back to let us know. That was a
    couple of years ago, when SP4 was first released. The last poster with the
    problem was last August, it just took a while for me to remember. I
    remembered it while I was making a reply to you.
    After you said you did have ZA on the machine, that nailed it in my mind. I
    had to go back and search my archived email for the resolution.


    --
    Best regards,
    Kevin D4 Dad Goodknecht Sr. [MVP]
    Hope This Helps
    ===================================
    When responding to posts, please "Reply to Group"
    via your newsreader so that others may learn and
    benefit from your issue, to respond directly to
    me remove the nospam. from my email address.
    ===================================
    http://www.lonestaramerica.com/
    ===================================
    Use Outlook Express?... Get OE_Quotefix:
    It will strip signature out and more
    http://home.in.tum.de/~jain/software/oe-quotefix/
    ===================================
    Keep a back up of your OE settings and folders
    with OEBackup:
    http://www.oehelp.com/OEBackup/Default.aspx
    ===================================
  18. Archived from groups: microsoft.public.win2000.dns (More info?)

    Good catch Kevin.
Ask a new question

Read More

DNS Servers Windows