2

We have a Domain controller (windows server 2012) in our LAN, there is also a DHCP server for clients to get them IP automatically.

enter image description here

all clients give right ip and dns configurations and work as well but these days we encounter a problem: some clients' DHCP configuration change to **use the following IP server ** unintentionally. and get some unknown DNS servers (172.18.x.x , 8.8.8.8)

tips:

  • There are no any modem or dhcp server else.
  • The users that login in clients don't have enough permission to change the configuration.

enter image description here

1

You need to enable registry auditing, and enable auditing for write/set permissions on the following key:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

Audit

Registry

3
  • Where it should be applied? in Domain controller or Clients ? – Hamid Shoja Jun 13 '20 at 3:27
  • 1
    The system where the change is occurring. – Greg Askew Jun 13 '20 at 13:01
  • Great, today I found the software that causes this problem. but I don't know how to restirct the software to prevent Dns configuration changes. – Hamid Shoja Jun 13 '20 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.