I have three Windows Server 2008 R2 VMs running on VirtualBox on an internal network IP addresses are,, and

All three hosts could ping each other originally.

I made .1 a domain controller and added .2 and .3 to the domain.

Since then .1 can ping all three servers while .2 and .3 can both ping .1 and themselves but not each other.

The firewall service is stopped and set to manual on all three servers.

What did I overlook?


Actually you don't have to re-clone the VM, just change the MAC value for the affected VMs from VM's Network's adaptor configuration under Advance options.


Turns out this was a function of VirtualBox internal network. The three servers were clones of each other (i.e. .2 was a clone of .1 and .3 was a clone of .2) and still shared some MAC-related things (oddly enough not the actual MAC address). For some reason this confused the VirtualBox internal network and the moment of confusion coincided with the time I used to install Active Directory on .1.

I re-cloned the VMs playing more attention to creating different MAC configurations (I don't know why the default is to leave it as is) and now things appear to work.

  • 1
    as a suggestion, don't turn off the firewall service, it does a lot more than firewall (they should have called it server security service). Leave it on but set the firewall to disabled if you do not want to use windows firewall. – Jim B Jan 8 '12 at 3:48
  • Good point. However in this case I had to configure several servers quickly just to try something out and disabling the service was much quicker than configuring the Firewall (and can be done from Powershell in a second). – Andrew J. Brehm Jan 8 '12 at 11:59
  • Sure, as long as you are aware if what you are setting (so that whatever you are testing is valid) eg you wouldn't want to test any software that relies on services with it disabled as service hardening isn't functioning properly. – Jim B Jan 9 '12 at 6:22
  • One thing at a time. First we make the thing work, then we harden the system. Don't want to guess whether something doesn't work due to permissions or due to not working per se. – Andrew J. Brehm Jan 9 '12 at 7:15

Why not just turn the firewall back on and simply enable echo requests in the advanced firewall settings?

One are you might want to check is what network your two member servers think they're part of. Make sure it says domain, or work.

  • If I turned the firewall back on just to allow pings, I'd take an unnecessary action just to undo its effect. The difference between domain, home and work only applies to a running firewall. – Andrew J. Brehm Jan 8 '12 at 2:01
  • I only mention that, as i've seen weird instances where the firewall rules are still appying even when turned off. Have your verified your complete network settings on all hosts? Also, do you maybe have another 3rd party firewall? I dunno, this just seems to scream firewall since you can ping from your clients to the DC and vice versa, but not to each other. – Eric C. Singer Jan 8 '12 at 2:09
  • It's always best to turn off the firewall, diagnose the problems and only then turn the firewall back on and configure it. Otherwise you add another layer that just makes the it harder to find the problem. – John Gardeniers Jan 8 '12 at 4:12
  • There is no third-party firewall installed on my test VMs. I agree with John. – Andrew J. Brehm Jan 8 '12 at 12:00
  • Its not always best to turn off the firewall, infact there many cases where you wouldn't want to do this. You have a specific problem your trying to solve, allowing echo requests via a firewall rule is simple to configure and simple to verify that its working. – Eric C. Singer Jan 8 '12 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.