DNS Entry

Anybody please help, this IP address(168.254.2.237) always appear in our
INTERNAL DNS SERVER entry as name server.

Even if i delete the IP after several minutes it will appear again, please
help.

In news:7AE9BD48-6DB7-4FED-95BF-39E12F85A09A@microsoft.com,
Flarex <Flarex@discussions.microsoft.com> requesting assistance, typed the
following:
> Anybody please help, this IP address(168.254.2.237) always appear in
> our INTERNAL DNS SERVER entry as name server.
>
> Even if i delete the IP after several minutes it will appear again,
> please help.


Go into the zone's properties, Nameservers tab, and delete it from the list.
It must have been put in at one time or another, or if this machine is a DC
and the zone is AD Integrated, on another DC.

By chance, was this DNS server a server that had two NICs and the outside
NIC connected to an ISP?

This IP belongs to a school district in Florida. Do you or your company have
a business relationship with this school district?

I used the following sites to look up 168.254.2.237:
http://ip-lookup.net/index.php
http://cqcounter.com/whois/

OrgName: Hillsborough County Public Schools OrgID:
HCPS-1Address: Hillsborough County Public Schools 901
Address: E. Kennedy Blvd. PO BOX 3408
City: TampaStateProv: FL
PostalCode: 33601-3408
Country: US NetRange: 168.254.0.0 - 168.254.255.255
CIDR: 168.254.0.0/16
NetName: HCSB-FLNetHandle: NET-168-254-0-0-1
Parent: NET-168-0-0-0-0
NetType: Direct Assignment
NameServer: SWATCHER.SDHC.K12.FL.US
NameServer: NS1.FIRN.EDU
Comment:
RegDate: 1994-10-25
Updated: 2002-06-05
RTechHandle: RL1118-ARIN
RTechName: LANEAU, RICK
RTechPhone: +1-813-272-4254
RTechEmail: rick.laneau@sdhc.k12.fl.us
# ARIN WHOIS database, last updated 2008-11-12 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
AS Number AS30536
Latitude 27°98'11" North
Longitude 82°34'30" West


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
Microsoft Certified Trainer

For urgent issues, you may want to contact Microsoft PSS directly.
Please check http://support.microsoft.com for regional support phone
numbers.

Hi, i went to the NAMESERVER tab and the IP was not there, it only appears in
our domain folder............i mean the IP is also in the entries like the
(same as parent folder), host etc.

And no, we have nothing to do with that school, that's why i want to delete
it. But everytime i delete it, it appears again after several minutes.

And no, our server only has 1 NIC.

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> In news:7AE9BD48-6DB7-4FED-95BF-39E12F85A09A@microsoft.com,
> Flarex <Flarex@discussions.microsoft.com> requesting assistance, typed the
> following:
> > Anybody please help, this IP address(168.254.2.237) always appear in
> > our INTERNAL DNS SERVER entry as name server.
> >
> > Even if i delete the IP after several minutes it will appear again,
> > please help.
>
>
> Go into the zone's properties, Nameservers tab, and delete it from the list.
> It must have been put in at one time or another, or if this machine is a DC
> and the zone is AD Integrated, on another DC.
>
> By chance, was this DNS server a server that had two NICs and the outside
> NIC connected to an ISP?
>
> This IP belongs to a school district in Florida. Do you or your company have
> a business relationship with this school district?
>
> I used the following sites to look up 168.254.2.237:
> http://ip-lookup.net/index.php
> http://cqcounter.com/whois/
>
> OrgName: Hillsborough County Public Schools OrgID:
> HCPS-1Address: Hillsborough County Public Schools 901
> Address: E. Kennedy Blvd. PO BOX 3408
> City: TampaStateProv: FL
> PostalCode: 33601-3408
> Country: US NetRange: 168.254.0.0 - 168.254.255.255
> CIDR: 168.254.0.0/16
> NetName: HCSB-FLNetHandle: NET-168-254-0-0-1
> Parent: NET-168-0-0-0-0
> NetType: Direct Assignment
> NameServer: SWATCHER.SDHC.K12.FL.US
> NameServer: NS1.FIRN.EDU
> Comment:
> RegDate: 1994-10-25
> Updated: 2002-06-05
> RTechHandle: RL1118-ARIN
> RTechName: LANEAU, RICK
> RTechPhone: +1-813-272-4254
> RTechEmail: rick.laneau@sdhc.k12.fl.us
> # ARIN WHOIS database, last updated 2008-11-12 19:10
> # Enter ? for additional hints on searching ARIN's WHOIS database.
> AS Number AS30536
> Latitude 27°98'11" North
> Longitude 82°34'30" West
>
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
> Microsoft Certified Trainer
>
> For urgent issues, you may want to contact Microsoft PSS directly.
> Please check http://support.microsoft.com for regional support phone
> numbers.
>
>

"Flarex" <Flarex@discussions.microsoft.com> wrote in message
news:C1F3CD4B-986E-4C93-AC5C-D86D2DEBBFD6@microsoft.com...
> Hi, i went to the NAMESERVER tab and the IP was not there, it only appears
> in
> our domain folder............i mean the IP is also in the entries like the
> (same as parent folder), host etc.
>
> And no, we have nothing to do with that school, that's why i want to
> delete
> it. But everytime i delete it, it appears again after several minutes.
>
> And no, our server only has 1 NIC.

The (same as parent) host record is actually the LdapIpAddress record. If
this DC is a GC, you will probably also see this under the
_gc._msdcs.domain.com zone in your SRV records. This comes from the Netlogon
service.

Try this:

Delete the \system32\config\netlogon.dns and netlogon.dnb files. Then run
in a CMD prompt:
ipconfig /flushdns
ipconfig /registerdns
net stop netlogon
net start netlogon

See if it is still re-registering.

If not...

How many DCs do you have?
Is your AD domain name the same as the school's?
What DNS server are your DCs using?
Do you have a forwarder configured?
Can you post an ipconfig /all of your DC(s) please?

Ace

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "Flarex" <Flarex@discussions.microsoft.com> wrote in message
> news:C1F3CD4B-986E-4C93-AC5C-D86D2DEBBFD6@microsoft.com...
> > Hi, i went to the NAMESERVER tab and the IP was not there, it only appears
> > in
> > our domain folder............i mean the IP is also in the entries like the
> > (same as parent folder), host etc.
> >
> > And no, we have nothing to do with that school, that's why i want to
> > delete
> > it. But everytime i delete it, it appears again after several minutes.
> >
> > And no, our server only has 1 NIC.
>
> The (same as parent) host record is actually the LdapIpAddress record. If
> this DC is a GC, you will probably also see this under the
> _gc._msdcs.domain.com zone in your SRV records. This comes from the Netlogon
> service.
>
> Try this:
>
> Delete the \system32\config\netlogon.dns and netlogon.dnb files. Then run
> in a CMD prompt:
> ipconfig /flushdns
> ipconfig /registerdns
> net stop netlogon
> net start netlogon
>
> See if it is still re-registering.
>
> If not...
>
> How many DCs do you have?
> Is your AD domain name the same as the school's?
> What DNS server are your DCs using?
> Do you have a forwarder configured?
> Can you post an ipconfig /all of your DC(s) please?
>
> Ace
>
> Hi, before i do this, is it safe to delete the netlogon.dns and netlogon.dnb files? i mean after deleting is there a possibility that our DC will not work or up anymore?

We have 3 DCs.
What do you mean by what DNS server are our DCs are using? i only configured
the default DNS server under administrative tools.
No, we don't have a forwarder configured.
How do i post the screen cap of our ipconfig/all? there's no attach button
here.

In news:6C6D74B0-CC30-45B1-9FF4-7113BCF0E016@microsoft.com,
Flarex <Flarex@discussions.microsoft.com> requesting assistance, typed the
following:

>> Ace
>>
>> Hi, before i do this, is it safe to delete the netlogon.dns and
>> netlogon.dnb files? i mean after deleting is there a possibility
>> that our DC will not work or up anymore?
>
> We have 3 DCs.
> What do you mean by what DNS server are our DCs are using? i only
> configured the default DNS server under administrative tools.
> No, we don't have a forwarder configured.
> How do i post the screen cap of our ipconfig/all? there's no attach
> button here.

Yes, it is safe to delete those files. The netlogon service uses those files
to register into the DNS zone that matches the name of the DC's Primary DNS
Suffix, sending the registration to the DNS servers in the DC's IP
properties. Each time the netlogon registers, it creates a new file, then
registers that information. My steps outline how to manually re-register the
netlogon service data in DNS.

My question regarding what DNS servers the DCs are using means what DNS IP
addresses are specified in the DC's IP properties. That is under the NIC's
properties.

To get a screen capture, you can simply copy and paste out of the command
prompt. Right click the top bar of the command prompt, properties, check the
checkbox that says QuickEdit mode, then click Ok, and then choose to allow
all future command prompt to apply this property. This will give you the
abiilty to drag your cursor in the command window. Once you drag an area,
you can then hit the ENTER button, which will copy it. Paste it in your
reply.

Another way is to run the ipconfig /all as such:
ipconfig /all > c:\ipconfig.txt.

Then open the ipconfig.txt file it created, and copy/paste the results into
your reply.

Ace

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
Microsoft Certified Trainer

For urgent issues, you may want to contact Microsoft PSS directly.
Please check http://support.microsoft.com for regional support phone
numbers.