1

I set up a new environment on a dual-nic set of servers. One of the physical networks has access to the internet, and uses public IP addresses. The second network is an internal network, no internet access and also contains the domain servers.

When it was set up, the servers that had both NICs marked the internal network as a domain network, and the external network as public.

A couple days back I logged in to a couple servers, and noticed that all the networks are now marked as domain networks! I have no idea what caused, this and I can't even change it, since the networking interface doesn't have the option to separate the two networks, and in the local group policy there's only one network present, not two of them.

This problem seems to have spread across the domain, since newly set up servers immediately get the same problem.

Please tell me there's a way to change that!

UPD: Not sure if it makes a difference, but the AD has multiple sites. I've set up the different subnets for the sites, and a VPN between them, but that was set up a month ago, and the networks became misconfigured only a couple days ago...

UPD 2: IPCONFIG from a server with two NICs (domain name and public IP (1.2.3.4) redacted):

Windows IP Configuration

   Host Name . . . . . . . . . . . . : NET-TEST-1
   Primary Dns Suffix  . . . . . . . : ad.example.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : ad.example.com
                                       fdf5:10::10.fdf5:10::1

Ethernet adapter Ethernet 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #2
   Physical Address. . . . . . . . . : 00-15-5D-0E-0D-09
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::808c:4842:6d60:4930%13(Preferred)
   IPv4 Address. . . . . . . . . . . : 1.2.3.4(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 1.2.3.1
   DHCPv6 IAID . . . . . . . . . . . : 369104221
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-C2-C2-5F-00-1D-D8-B7-1C-2E
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : fdf5:10::10.fdf5:10::1
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-1D-D8-B7-1C-2E
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : fdf5:10::7285:9a19:3f15:1ef3(Preferred)
   Lease Obtained. . . . . . . . . . : 05 October 2014 13:16:50
   Lease Expires . . . . . . . . . . : 17 October 2014 10:06:28
   IPv6 Address. . . . . . . . . . . : fdf5:10::c8f0:634c:2991:dabd(Preferred)
   Link-local IPv6 Address . . . . . : fe80::c8f0:634c:2991:dabd%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.0.22(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 301997528
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-C2-C2-5F-00-1D-D8-B7-1C-2E
   DNS Servers . . . . . . . . . . . : fdf5:10::10
                                       fdf5:10::11
                                       10.0.0.10
                                       10.0.0.11
   NetBIOS over Tcpip. . . . . . . . : Enabled
  • Would you kindly post IPCONFIG /all? – Twisty Impersonator Oct 5 '14 at 18:06
  • Just added that in – Artiom Oct 5 '14 at 19:11
2

Windows uses the Network Location Awareness service to determine which profile should be assigned to each network adaptor.

For Windows 2008 R2 and above Windows will only assign the domain profile to a network adaptor if the server is domain joined and it can communicate with a domain controller for the same domain through that adaptor.

For Windows 2008 it's slightly different; Windows will only assign the domain profile if a valid domain controller is reachable through every network adaptor on the server.

For reference: http://technet.microsoft.com/en-us/library/cc753545(v=ws.10).aspx

I would test this by disconnecting the internal network adaptor and then pinging each of your domain controllers in turn. If you get a response then you need to investigate the routing between the supposedly external network adaptor and your internal network - somewhere you will be bridging the networks. Try a tracert to see if you can narrow down where the bridging might be occurring.

Hope that puts you on the right track.

  • Question.. My other sites also have domain controllers, and they're connected to the main site over a VPN, and that goes over the external gateway... Could that be the reason why the external adapter is marked as a domain adapter (even though the domain controllers are in different sites) ? – Artiom Oct 6 '14 at 13:17
  • Potentially, yes, depending on how you have the VPN routing setup. The external network adaptors should not be able to route traffic over the site to site VPN; only the internal network adaptors should be able to do this. Site to site VPN setup is not my strong point; but my gut feeling is you definitely need to be looking in this area. – Steve365 Oct 6 '14 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.