2

We have a Windows 2012 VMWare virtual machine that has three virtual network adapters.

  1. "LAN network" on IP address q.x.y.72
  2. "iSCSI 1" on IP address q.a.b.119
  3. "iSCSI 2" on IP address q.a.b.118

The problem is that iSCSI 1 keeps showing up in DNS. Every day at exactly 2:00:00 PM, iSCSI 1's IP address gets registered in DNS. We manually delete the record from DNS. And it re-appears the next day at the same time.

Note that neither iSCSI 1 or 2 have a gateway configured, so they shouldn't be able to reach the domain controllers from those IPs. Neither has a DNS server configured. Neither has "Enable LMHOSTS lookup" checked and both have "Disable NetBIOS over TCP/IP" marked.

Note that neither iSCSI 1 or 2 have "Register this connection's address in DNS" checked. That was the solution to this similar question.

IPv6 is disabled on all 3 connections.

I've checked this server's event logs and see nothing in the minutes before and after 2:00 PM to indicate what's going on. There are no scheduled tasks on this server.

iSCSI 2 behaves as expected; it doesn't show up in DNS. iSCSI 1 is configured exactly the same, except for the IP address.

We've confirmed that the manual DNS record deletion gets replicated to all domain controllers, so there are no "ghost" entries that somehow get replicated back instead of deleting cleanly.

What could be causing this network adapter to register in DNS?

  • 1
    Sounds like some 3rd party process is likely putting those records back in. I would be auditing your DNS server to see where those requests are coming from. You have a pretty narrow window, which should make it easy. A 1:59pm fire up a packet capture. At 2:01pm stop the packet capture. Then you can see if the record is coming from the machine itself, or some other location (an IPAM suite or something?) – Mark Henderson Mar 13 '17 at 15:20
  • We have not yet tried a packet capture or auditing the DNS server/DC. Must put that on our to-do list. – CaM Mar 13 '17 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.