Strange computers on network

  • Thread starter Thread starter Ron Grove
  • Start date Start date
R

Ron Grove

I have W2K network with AD. When I look at my entire network/Microsoft
windows networks I noticed a computer that should not be on my computer
showing up there. How can I figure out who it belongs to and how to remove
it?

Thanks.
 
I have W2K network with AD. When I look at my entire network/Microsoft
windows networks I noticed a computer that should not be on my computer
showing up there. How can I figure out who it belongs to and how to remove
it?

Thanks.
Click to expand...
Are you connecting thru a router? If so just put your MAC addresses in
the settings and tell it not allow any others in.
If you are wireless, use a WEP key that is not guessable!!!
WEP is case sensitive, insperse letters with numbers and caps and you
have a key that will take a very long time to guess.
I did not say CRACK, I said guess. Anyone with enough time and
resources can crack anything!
 
Probably appearing in your browselist as a result of a laptop working
offsite while on another LAN
 
Use nbtstat -a <pcname> this should return a number of
lines, the last one being the currently logged on user,
do you recognise the name?
 
in message : I have W2K network with AD. When I look at my entire network/Microsoft
: windows networks I noticed a computer that should not be on my computer
: showing up there. How can I figure out who it belongs to and how to remove
: it?

From a command line...

To see NetBIOS information:
nbtstat -a computername or nbtstat -A ip address

Anonymous connection:
net use \\computername\ipc$ "" /u:""
There are spaces after net, use, $ and the first "".

Then to see shares:
net view \\computername

If you're using switches, you may get information there to show you which
port they're connected to but you will need IP or MAC information. Nbtstat
line above will show MAC address. Once you know which port it is connected
to if you have a layout of your network to what ports go where, you know
exactly where it is.

Note: If it's not on the list and you don't have any wireless, someone may
have introduced an AP (Access Point) into your network so you will need to
then verify all MAC addresses to each user, which you can get out of DHCP
for workstations. A connection to an AP somewhere in your network will show
a MAC address at the switch or with a packet sniffer but it will not show a
computer connected to one, especially if it is connected wirelessly. This
will help you to track it down.

As one poster said, it may be a laptop and hopefully that is all it is and
not some rogue element however, we have found APs hidden in walls and wired
into the network. You should know all MAC addresses on your network and
block any that are not in your ACL, which should also verify other
information to make sure it's not being impersonated.

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Online Support for IT Professionals -
http://support.microsoft.com/servicedesks/technet/default.asp?fr=0&sd=tech
How-to: Windows 2000 DNS:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308201
 
Back
Top