Click here to get back home

Unknown workgroup in Microsoft Windows Network

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Unknown workgroup in Microsoft Windows Network Bill Board 03-12-2008
Posted by Dobromir Todorov on March 14, 2008, 11:52 am
Please log in for more thread options
Bill,

There used to be a Browser Monitor tool in the Windows NT 4 Resource Kit,
which I believe you should still be able to download.

The tool will show you all the master and backup browsers on your network,
as well as the computers and domains/workgroups they know of. It does not
necessarily say which are "good" - I guess you will still need to review the
list manually.

--
---
HTH,
Dobromir

Visit http://www.iamechanics.com

>I guessed some did what you mentioned, but I was thinking perhaps there was
>a utility that you give a list of "good" workgroups/domains and if it see
>others than what's in its good list it send a notice. This way I could be
>a little quicker in finding the person/device.
>
> "Lanwench [MVP - Exchange]"
>>> Recently a new workgroup/domain appeared in our "Network Neighborhood
>>> > Microsoft Windows Network" We are running Windows 2003 Server
>>> with Windows XP Pro workstations in our network.
>>>
>>> Two questions:
>>>
>>> 1. I only found this by chance when I was looking in Network
>>> Neighborhood. Is there a way that I could be alerted if a new
>>> workgroup or domain appear?
>>> 2. How can we track this back to who or what IP address device
>>> attached to the network?
>>>
>>> Thanks,
>>> Bill
>>
>> Most likely, someone simply connected a hon-domain-member laptop or PC to
>> the network once, and it's gone now. The workgroup name will eventually
>> go away & not be visible. If you want to prevent stuff like this from
>> happpening in the future, you can either invest in a fancy-shmancy
>> Ethernet switch that won't give unauthorized computers an IP address, or
>> do the cheap & cheerful (and less effective) thing - disconnect any
>> unused Ethernet jack from your switch in the server room/closet/whatnot.
>>
>
>



Posted by Steve Halvorson on March 12, 2008, 5:21 pm
Please log in for more thread options
Use a program like "Look at Lan" it scans an IP range and alerts you (Star
Trek Alert Sound) whenever it discovers a new IP address. You can save your
network profile and it will only alert when something new is connected.
--
Steve Halvorson



"Bill Board" wrote:

> Recently a new workgroup/domain appeared in our "Network Neighborhood >
> Microsoft Windows Network" We are running Windows 2003 Server with
> Windows XP Pro workstations in our network.
>
> Two questions:
>
> 1. I only found this by chance when I was looking in Network Neighborhood.
> Is there a way that I could be alerted if a new workgroup or domain appear?
>
> 2. How can we track this back to who or what IP address device attached to
> the network?
>
> Thanks,
> Bill
>
>
>
>
>

Posted by Anteaus on March 14, 2008, 12:01 pm
Please log in for more thread options

A slightly lateral approach, if you turn off the Computer Browser and Server
services on desktops, that will stop users from creating or finding
unauthorised shared resources. It will also improve your security somewhat.

As such it won't stop someone connecting an unauthorised computer, but it
will to some extent mitigate the security risks which that poses.

You can (obviously) only do this if all of your resources are centrally
hosted, it would not be suitable if you (for example) rely on peer-shared
printers.


"Bill Board" wrote:

> Recently a new workgroup/domain appeared in our "Network Neighborhood >
> Microsoft Windows Network" We are running Windows 2003 Server with
> Windows XP Pro workstations in our network.


Posted by Lanwench [MVP - Exchange] on March 15, 2008, 9:37 am
Please log in for more thread options
> A slightly lateral approach, if you turn off the Computer Browser and
> Server services on desktops, that will stop users from creating or
> finding unauthorised shared resources. It will also improve your
> security somewhat.

Hmmm - no....if you want security, you use NTFS permissions to lock things
down. You can also use hidden shares. Browsing is not a security issue - if
you want to see shares on a server, \server will show them to you. And if
you turn off the Server service you cannot as an admin remotely manage a PC.

I do generally turn off the Computer Browser on workstations - this works if
you use WINS. But that isn't for reasons of security -it's performance &
browser election issues.
>
> As such it won't stop someone connecting an unauthorised computer,
> but it will to some extent mitigate the security risks which that
> poses.

How so?
>
> You can (obviously) only do this if all of your resources are
> centrally hosted, it would not be suitable if you (for example) rely
> on peer-shared printers.

The server service, yes. Computer Browser, no....you can connect to
\workstation\printer regardless.
>
>
> "Bill Board" wrote:
>
>> Recently a new workgroup/domain appeared in our "Network
>> Neighborhood > Microsoft Windows Network" We are running Windows
>> 2003 Server with Windows XP Pro workstations in our network.




Similar ThreadsPosted
Microsoft Network Server: Digitally Sing Communications January 16, 2008, 3:16 am
allow user to Start, Stop and Pause a Windows Service on a Workgroup Computer December 12, 2006, 10:18 am
Possible compromise of Windows Server 2003 security risk & unknown users December 7, 2005, 11:29 am
Install Microsoft PKI for Windows Server 2003 January 22, 2007, 4:02 pm
Windows 2003: Netstat results mention microsoft-ds December 4, 2006, 1:40 am
When Microsoft Releases it's Updates for windows server 2003? April 10, 2008, 6:35 am
Windows 2003 Standard Edition & Microsoft.XMLHTTP Question September 30, 2006, 10:25 pm
Antigen for SMTP in Workgroup July 11, 2006, 4:56 am
Distributing Certificates (Computer) to workgroup computers May 13, 2008, 7:01 pm
Unknown Publisher for *.lnk? October 7, 2005, 11:46 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap