I have a problem where Windows Server 2003 takes lots of DHCP addresses althought there is only 1 NIC in that server and with DHCP disabled (see information below).

However, as you can see, MAC address in DHCP client table on router does not match the one server NIC has.

It's a D-Link DWL-2000AP+ cheap wireless router with DHCP enabled.

DHCP Client Table

navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55  
navserver 52-41-53-20-00-13 Jan/03/1970 09:12:55

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : navserver
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : HP NC7761 Gigabit Server Adapter
   Physical Address. . . . . . . . . : 00-13-21-1C-EB-50
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . :
   Subnet Mask . . . . . . . . . . . :
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . :

I have no idea how to solve this issue. Could you help me please?

As it appears, RRAS service is enabled. However i`m afraid to disable it. Could it be that fax/modem is using it? I don't administer the server but not long ago someone set up fax/modem to that server. Not sure if it works, but they want it to work.

I see many warnings like this:

The user navserver connected from but failed an authentication attempt due to the following reason: Authentication was not successful because an unknown user name or incorrect password was used. 

And errors:

A Demand Dial connection to the remote interface Remote Router on port VPN4-4 was successfully initiated but failed to complete successfully because of the  following error: Access was denied because the username and/or password was invalid on the domain.

associated to remote access.

Could these issues somehow be linked?

Or maybe i just block that mac address from dhcp server and live happily ever after?

Thank you.

  • It doesn't look like the server is, in fact, taking any of those addresses. Is there another box on the LAN?
    – staticsan
    Jun 10, 2009 at 5:54
  • There are ~50 devices on lan, mostly using static addresses. But several use DHCP. Jun 10, 2009 at 5:55

5 Answers 5


Are you running RRAS (Routing and Remote Access Services) on the server? Maybe this forums thread can help: Windows 2003 DHCP issuing RAS addresses.

The fact that you see 10 IP addresses is cuased by the fact, that RAS obtains, by default, 10 IP addresses to lease to clients. If all 10 IP addresses are used, RAS obtains 10 more.

And read this article about the DHCP relay agent and this Microsoft Support article.


If the modem is only used for sending and receiving fax, RRAS is not needed. But you should check/ask, if this server is also used as a network router and/or for accounts which connect from remote.

If you wish to disable RRAS without un-installing, you could go to the Windows Services panel and change the "Routing and Remote Access Service" to disabled.

If you are sure you won't use RRAS, open the RRAS console, right click on the server name and choose "Disable RRAS". If you later want to enable it again, you'll have to reconfigure RRAS.

  • +1 for having the same thought. :)
    – kentchen
    Jun 10, 2009 at 7:00
  • 1
    To save you some clicking, that article links to support.microsoft.com/kb/160699
    – Zoredache
    Jun 10, 2009 at 7:14
  • This appeared helpful. However could you check updated question? Thank you. Jun 10, 2009 at 7:50
  • Anyway accepted answer. Because Faxmodem is already a different problem. But disabling RRAS or more specifically - only the external interface used by RRAS fixed the problem. Jun 10, 2009 at 11:51
  • Ok, well, the computer is not used as a router. However will this service not affect people connecting to server from remote desktop? Thank you. Jun 12, 2009 at 6:46

The first thing to do would be to find out what device has that MAC address. It's not the server.

If you have 50 devices and "most" already have static addresses, could you do away with DHCP altogether and use only static addresses?

I'm not very familiar with DLink routers, but if I had a Win2003 server around, I'd use that as a DHCP server instead of the router.

In case you need it, here are a couple links on setting up a DHCP Server on Windows 2003:

Microsoft Tecnhet: Configuring a DHCP Server

WindowsNetworking.com step by step overview of setting up a DHCP server

  • Can't get away with it - we have wireless devices where none wants to change from static to dhcp addresses time-to-time. Windows provides alternate IP configuration, it worked but then again we experienced some bugs where we a computer assigns himself a 169.x (or was it 162.x) addresses. Jun 10, 2009 at 7:12

Just a random thought. maybe you have RRAS (Routing and Remote Access Service) running on this 2003 box which while take addresses from DHCP server. Worth checking though.

  • Didn't see your answer until now. +1
    – splattne
    Jun 10, 2009 at 8:45

Just because the hostname in your DHCP client table matches the hostname of your server does not mean its the same machine. The first thing I would do is block the MAC address taking all those IPs on your DHCP server to figure out what machine is requesting them.

It could be a misconfigured machine on your network or a rogue machine trying to spoof your server. In any case it needs to be fixed.

Also fix the date on your DHCP server.

Additional things to think about

  • According to the IEEE the MAC Address (assuming you have not modified it) listed in your DHCP server logs is most likely spoofed as it has no real manufacture associated with it. Your MAC Address on your server however is associated to HP.

  • Replacing your DHCP server will not fix the issue. You need to find the device that is requesting the address. Based on the fact this is a wireless router I would assume its your next door neighbor or the guy with the big antenna on the back of his car parked outside your house.

  • It cannot be the big guy with the antenna, because the building is in huge limited access territory and we know who owns what wireless devices. I'll try to find the guilty device. Jun 10, 2009 at 7:11
  • If it is a legit device the easiest way to find it is to disable it.
    – GNUix
    Jun 10, 2009 at 7:16

Silly question - someone hasn't been playing with VPNs somewhere on the network have they? A VPN server will grab a block of DHCP addresses just like that.

You might try the arp ping tool to see what responds when you try searching for the allocated IP addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.