Our WIndows Server 2003 DHCP scope is being filled with BAD ADDRESS leases. This happened after we started deploying Vista to the domain. It is most prevalent when a user disconnects from their wired connection and plugs back in on an alternate location.

I have ran wireshark on the DHCP server and can see the client machine refusing the DHCP address. The client requests the DHCP Address as evidenced by a DHCP REQUEST entry in the wireshark log and this is immediately followed by a DHCP DECLINED entry. It is a limited number of laptops affected by this (only Vista so far, it does affect our XP and other laptops when we run out of addresses though) The addresses it declines are valid and not currently in use.

I have turned of conflict detection on the DHCP server but it is still filling it with BAD ADDRESS entries. In these cases the user cannot get an IP address.

Another possibly related issue is that there are several users reporting IP Address Conflict messages on their laptops and workstations. These are all served from the same DHCP server. The problem is most apparent when they disconnect either wired or wireless connections or bring their machines out of hibernate mode.

My belief is that this is caused by something in Vista but it has not been resolved by deploying SP2. All machines that users report both issues (NOt able to get an address, IP address conflict) are running Vista while machines running XP get only the IP Address conflict message.

THe DHCP Lease time is 3 days. Should this be reduced? Should I reenable conflict detection? Or should I just put XP SP3 on the machines that I can?

There are 2 DHCP servers in play, they share the same scope but have mutual exclusions, it's to cover us in the event of a failure as per the 80:20 rule. The problem occurred before I added the second DHCP server.

I have scanned the network for rogue DHCP servers, I have also disabled our DHCP server (only one at that time) and requested a DHCP address, none was received.

Also, most of the machines affected have virtual PC or virtual server running.

  • The problem appears to stem from Symantec Endpoint Protection 11.04 and it's network threat detection. Disabling this on the server to see if it fixes the issue. On another note I do NOT like applications installing dummy drivers "For Your Protection"
    – Dan
    Jun 16, 2009 at 8:48

6 Answers 6


BAD_ADDRESS is IP address confliction, so the DHCP-server obviously gets a reply when it tries to ping those addresses. Have you tried using ping manually from the DHCP server? You could also try to look at the arp cache (arp -a in a commandline shell).

  • The IP addresses are definitely not live. I've tried pinging them and get no response (from the DHCP server box) I haven't looked at the ARP cache yet
    – Dan
    Jun 11, 2009 at 15:20
  • 1
    Windows firewall drops incoming icmp echo requests by default, look at your ARP cache after the ping.
    – pauska
    Jun 11, 2009 at 15:37
  • pauska, great advice, upvote for you! :) Jun 11, 2009 at 16:13

Our problem stemmed from a particular set of circumstances. Vista SP1 + SP2
"Mobile" users
Incomplete Wireless coverage with poor handover
Users putting their machines into hibernate and moving them off and on the network

This caused Symantec Endpoint Protection, specifically the Network Threat Protection component to throw a fit. Disabling this component and the problem has not reoccurred. I'm 99% confident that it was symantec as we experienced the exact same issue on another site that had symantec deployed that day.

The fix for this is to reboot the problematic machine and disable Network Threat Protection. We have a call logged with Symantec to see if this is a known issue or a potential misconfiguration. I am strongly considering recommending a move away from Symantec and sleecting trend as our A/V provider.

  • please note, after redeploying SEP without Network Threat Protection we have had no issues with DHCP. Make of that what you will.
    – Dan
    Feb 19, 2010 at 13:40

I don't believe that this is an inherent vista issue. No version of Vista has had this problem in our mixed environment. Could it be that some how, the NIC cards in the Vista machines were reflashed to have the same MAC address? I think that would have those symptoms. You say that wireshark shows the vista machines refusing DHCP address. Did they ask for it and then refuse it? Could a weirdo nic driver cause this problem?

Another thought is that Vista does attempt to detect what network you are on so that it can set the firewalls appropriately. When you move machine from one location to another, is it clearly a different subnet or does it share the same IP range?

  • There is a possibility that it could be a weird NIC issue as they are all dell laptops with the same cards. It's the same subnet, server and wired/wireless network (wireless bridges in play allowing roaming the building - I don't agree with it but it has to stay) The machine actively asks for it as evidenced by the DHCP Request swiftly followed by a DHCP Decline
    – Dan
    Jun 11, 2009 at 15:23
  • Also, is there a way to tell vista that EVERY network you connect to is type XYZ so it doesn't waste time mucking about trying to find out what it is.
    – Dan
    Jun 11, 2009 at 15:30
  • 2
    NIC card .... gaaaah! Jun 15, 2009 at 11:03
  • I know, "welcome to the department of redundancy department"
    – Dan
    Sep 15, 2009 at 16:04
  • 1
    Guilty as charged. :)
    – Knox
    Sep 15, 2009 at 17:06

I agree with pauska, it's ip address conflicts. You MAY have;

a.) Another overlapping DHCP server issuing addresses, which is conflicting with the scope that you're issuing now.

b.) I agree wholeheartedly with reducing the lease time. I would set it to 8 hours or so, and delete the "BAD_ADDRESS" entries. You'll see more conflicts, but as the workstations let the addresses go, they'll renew OK. (Provided you don't have a rogue DHCP server out there! :)

If you begin to get reports of offending workstations getting the "ip address conflict!" messages, run "ipconfig /release && ipconfig /renew" on the problematic machines.

Oh, also.. Be forewarned, if you're using AD-integrated dynamic DNS, where your machines automatically update themselves in your DC's, once you kick down that lease time, you're going to need to compensate by scavenging those DNS entries. Maybe you could append that line up there and add, "&& ipconfig /registerdns"


  • a. There is an overlapping DHCP Server with the same scope but it has exclusions for the primary DHCP so they don't share the address pool (80:20 rule) b. I'm going to set this shortly I am using AD Integrated DNS, is there a way to automate the harvesting of DNS entries or is it just a matter of waiting?
    – Dan
    Jun 11, 2009 at 15:24
  • Ahh!!! It may have exclusions, but I'm willing to bet a beer at the pub that's where you're running into some of your issues.. There is a way to automate it, if I understand you correctly; open properties for your domain in DNS admin tool, click on "Aging" and make sure those settings jive. Jun 11, 2009 at 16:12
  • I've shortened the lease to 8 hrs, disabled the second DHCP server and we are still experiencing the BAD ADDRESS Entries. There are no entries in the event logs for the server affected.
    – Dan
    Jun 15, 2009 at 11:44
  • Ah! Hey, I was kinda wondering what ever happened with Dan-and-his-DHCP. Hmmm. A quandry for sure. Is there any way you can temporarily disable the other DHCP scope for testing purposes? Setting those address leases for a super-long time, or assigning static IP addresses? Jun 15, 2009 at 13:50
  • I find that my Vista laptop has a tendency to do strange things if it is put into Hibernate with it's wireless card active. I don't know if that has anything to do with what you are seeing, but can you convince your users to disable their wireless card before putting their laptops to sleep? At least long enough to see if that fixes the problem. Jun 15, 2009 at 15:55

It's a problem with the broadcast flag in DHCP in Vista.

Check out this article for fixing your DHCP problems. http://thedaneshproject.com/posts/vista-not-working-with-dhcp/


Just Make IP to Mac Binding or in simple words just reserve those IPs in DHCP which showing as Bad address. It would work fine

  • 1
    This only works if you aren't managing 200+ machines. It's not really feasible to have MAC binding in DHCP for this type of purpose. I don't think it would have worked in this situation as SEP was blocking the firewall request.
    – Dan
    Mar 1, 2012 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.