workgroup name returns to default

  • Thread starter Thread starter Barrett Bonden
  • Start date Start date
B

Barrett Bonden

Client's new XP home machine's workgroup name refuses to hold on his new
setting; oddly it will stay for a re-boot or two, and then returns to
"mshome"
 
Maybe client is trying to change the name of his workgroup to the same name
of his computer?

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
Sorry I mean "another" computer not his own i.e. if he is on a cable
Internet connection i.e. neighborhood LAN...

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
Mitch:

Interesting; do I understand you ?
He is, indeed, on a cable internet connection: he's the only PC on a cable
modem back to the ISP - but I've seen this prior without ( I think) this
being an issue....are you saying that there needs be a common workgroup in
this case ?
I've done lots of LAN's , and set up many a workgroup...why would there
need to be commonality on this level at all ?
Customer gets a dynamic IP from the cable guys....if he feels safer with
his own workgroup name (scared of break ins) why should he not be able to
set it ?
 
No, I was just thinking out loud. I thought if he tried naming his workgroup
the same as the name of a computer in a different workgroup on the same LAN
that a conflict might arise. I was wrong though--just tried it and it works,
and of course the NetBIOS names for computers and workgroups contain a
hidden 16 character anyways that distinguishes between them...

Anyway, I'll keep thinking about this and see if I can come up with
something...

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
I've been racking my brains on this as its an interesting problem. I guess
you've tried running antivirus/antispyware programs on the affected machine?

Other ideas...maybe check the Startup folder, Run registry keys etc to see
if any unusual program or script runs when you boot your machine...try
disabling System Restore (maybe the machine is automatically rolling itself
back to a previous restore point for some reason?)...try running System File
Checker (sfc command) to see if any system files are corrupt and need to be
replaced...

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
....anything unusual events logged to the System or Application log when this
occurs?

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
some good ideas ; I'll be back to the client soon ; will let you know; if
any other thoughts strike you please share; I've found nothing else on the
web -
 
Some more ideas...are Remote Desktop/Remote Assistance enabled? Maybe
someone is clandestinely changing the workgroup name back...check Local
Users and Groups for unknown admin-level accounts...change the admin
password in case someone unauthorized is coming in at night to access the
machine...enable auditing for Account Logon Events and Logon Events to keep
a trail of who is accessing the maching using the Administrator
account...monitor the Workstation service on the machine because this
service is the event source for System log events indicating that a machine
has joined a workgroup...enable auditing for Privilege User and filter for
all events having ID 577 as these events indicate the current domain or
workgroup name in the Primary Domain field, that way you can try and
pinpoint the exact time when the workgroup name changes back...

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
Just posted some additional suggestions back in this thread a bit :-)

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
BTW the event in System log indicating that the machine has joined a
workgroup is event ID 3260 source Workstation. Search for these events in
the System log and then examine events immediately prior to this in System,
Application, and Security logs...

--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com

This posting is provided AS IS with no warranties and confers no rights.
 
Back
Top