Click here to get back home

Unknown workgroup in Microsoft Windows Network

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Unknown workgroup in Microsoft Windows Network Bill Board 03-12-2008
Posted by Bill Board on March 12, 2008, 10:38 am
Please log in for more thread options
Recently a new workgroup/domain appeared in our "Network Neighborhood >
Microsoft Windows Network" We are running Windows 2003 Server with
Windows XP Pro workstations in our network.

Two questions:

1. I only found this by chance when I was looking in Network Neighborhood.
Is there a way that I could be alerted if a new workgroup or domain appear?

2. How can we track this back to who or what IP address device attached to
the network?

Thanks,
Bill





Posted by Lanwench [MVP - Exchange] on March 12, 2008, 10:45 am
Please log in for more thread options
> Recently a new workgroup/domain appeared in our "Network Neighborhood
> > Microsoft Windows Network" We are running Windows 2003 Server
> with Windows XP Pro workstations in our network.
>
> Two questions:
>
> 1. I only found this by chance when I was looking in Network
> Neighborhood. Is there a way that I could be alerted if a new
> workgroup or domain appear?
> 2. How can we track this back to who or what IP address device
> attached to the network?
>
> Thanks,
> Bill

Most likely, someone simply connected a hon-domain-member laptop or PC to
the network once, and it's gone now. The workgroup name will eventually go
away & not be visible. If you want to prevent stuff like this from
happpening in the future, you can either invest in a fancy-shmancy Ethernet
switch that won't give unauthorized computers an IP address, or do the cheap
& cheerful (and less effective) thing - disconnect any unused Ethernet jack
from your switch in the server room/closet/whatnot.



Posted by Bill Board on March 12, 2008, 11:10 am
Please log in for more thread options
I guessed some did what you mentioned, but I was thinking perhaps there was
a utility that you give a list of "good" workgroups/domains and if it see
others than what's in its good list it send a notice. This way I could be a
little quicker in finding the person/device.

"Lanwench [MVP - Exchange]"
>> Recently a new workgroup/domain appeared in our "Network Neighborhood
>> > Microsoft Windows Network" We are running Windows 2003 Server
>> with Windows XP Pro workstations in our network.
>>
>> Two questions:
>>
>> 1. I only found this by chance when I was looking in Network
>> Neighborhood. Is there a way that I could be alerted if a new
>> workgroup or domain appear?
>> 2. How can we track this back to who or what IP address device
>> attached to the network?
>>
>> Thanks,
>> Bill
>
> Most likely, someone simply connected a hon-domain-member laptop or PC to
> the network once, and it's gone now. The workgroup name will eventually go
> away & not be visible. If you want to prevent stuff like this from
> happpening in the future, you can either invest in a fancy-shmancy
> Ethernet switch that won't give unauthorized computers an IP address, or
> do the cheap & cheerful (and less effective) thing - disconnect any unused
> Ethernet jack from your switch in the server room/closet/whatnot.
>



Posted by Lanwench [MVP - Exchange] on March 12, 2008, 11:26 am
Please log in for more thread options
> I guessed some did what you mentioned, but I was thinking perhaps
> there was a utility that you give a list of "good" workgroups/domains
> and if it see others than what's in its good list it send a notice. This
> way I could be a little quicker in finding the person/device.

No, not that I know of. You could disable NetBIOS over TCP/IP entirely if
you don't want to see stuff like this. But I'd issue a memo reminding people
not to connect unauthorized computers" and make sure it's part of your
computer use agreement - make employees sign it, even.


>
> "Lanwench [MVP - Exchange]"
>>> Recently a new workgroup/domain appeared in our "Network
>>> Neighborhood
>>>> Microsoft Windows Network" We are running Windows 2003 Server
>>> with Windows XP Pro workstations in our network.
>>>
>>> Two questions:
>>>
>>> 1. I only found this by chance when I was looking in Network
>>> Neighborhood. Is there a way that I could be alerted if a new
>>> workgroup or domain appear?
>>> 2. How can we track this back to who or what IP address device
>>> attached to the network?
>>>
>>> Thanks,
>>> Bill
>>
>> Most likely, someone simply connected a hon-domain-member laptop or
>> PC to the network once, and it's gone now. The workgroup name will
>> eventually go away & not be visible. If you want to prevent stuff
>> like this from happpening in the future, you can either invest in a
>> fancy-shmancy Ethernet switch that won't give unauthorized computers
>> an IP address, or do the cheap & cheerful (and less effective) thing
>> - disconnect any unused Ethernet jack from your switch in the server
>> room/closet/whatnot.




Posted by David H. Lipman on March 12, 2008, 4:08 pm
Please log in for more thread options

| I guessed some did what you mentioned, but I was thinking perhaps there was
| a utility that you give a list of "good" workgroups/domains and if it see
| others than what's in its good list it send a notice. This way I could be a
| little quicker in finding the person/device.
|

There is no such list.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Similar ThreadsPosted
Microsoft Network Server: Digitally Sing Communications January 16, 2008, 3:16 am
allow user to Start, Stop and Pause a Windows Service on a Workgroup Computer December 12, 2006, 10:18 am
Possible compromise of Windows Server 2003 security risk & unknown users December 7, 2005, 11:29 am
Install Microsoft PKI for Windows Server 2003 January 22, 2007, 4:02 pm
Windows 2003: Netstat results mention microsoft-ds December 4, 2006, 1:40 am
When Microsoft Releases it's Updates for windows server 2003? April 10, 2008, 6:35 am
Windows 2003 Standard Edition & Microsoft.XMLHTTP Question September 30, 2006, 10:25 pm
Antigen for SMTP in Workgroup July 11, 2006, 4:56 am
Distributing Certificates (Computer) to workgroup computers May 13, 2008, 7:01 pm
Unknown Publisher for *.lnk? October 7, 2005, 11:46 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap