Event 1053 Dhcpserver shutdown

**AlanCates** · April 15th, 2004, 10:38 AM

The DHCP/BINL service on this computer running Windows Server 2003 for Small Business Server has encountered another server on this network with IP Address, 192.168.0.1, belonging to the domain: .

I setup a new SBS 2003 and now repeatedly get error event 1053 1054 and the dhcp server shuts down. The dhcp was activated for the AD and worked for a couple of days. The rogue server dectection in the '03 dhcp seems to see another dhcp server.

Using nmap I have scanned the LAN and WAN via tcp and udp for another dhcp server. I cannot find one. I have verified that there is no other computer at 192.168.0.1.

I have reinstalled dhcp service. no help. I am searching the net for a solution. All so far seem to involve finding the other dhcp server. I only have 10 cmputers on the network. I know that none of them use 198.162.0.1 and none have a dhcp server.

Anyone have any ideas on what is up?

**NooNoo** · April 15th, 2004, 12:23 PM

Welcome to Windrivers Alan

Whats the dns server up to?

Did you exclude 192.168.0.1 from the scope?

**AlanCates** · April 15th, 2004, 03:12 PM

DNS... Yesterday I had some 4015 events in DNS. Today there are no errors reporting. Events show DNS starting and nothing since.

The first 10 addresses are exluded from scope 192...1-10.

Printer addresses are excluded 192...190-199

There are no reservations. All computers in the net use dhcp other than the DC. The install is a basic SBS. There is an oddity in the DNS... it shows:

Code:

DNS
    (S) DSI44929
         (F) Event Viewer 
         (F) Forward Lookup Zones
              (F) _msdcs.[mydomain].com
              (F) [mydomain].com
                   (F) _mdcs
                   (F) _sites
        ...snip

I haven't seen _msdcs.[mydomain].com outside the [mydomain].com folder before so I assume it is an SBS thing. DNS is working so I assume all is well with DNS.

**NooNoo** · April 18th, 2004, 02:03 PM

You have a router?

**AlanCates** · April 19th, 2004, 06:09 PM

Everyone's suggestion over the last few days is to look for another Dhcp server on the network. I have spent considerable time searching for a server. I finally found it.

Seems the phantom server is in SBS itself. RRAS service has a Dhcp server for dialup clients. If this service is configured to service dialup and VPN clients, it can become a second Dhcp service and show mshome.net as the domain. See the Event 1053 information at minasi.com/forms for more details. In System Manager one must drill down through Advanced Managment, RRAS to Nat/Firewall Properties and Address Assignment to shut off or reconfigure the assignment.

I am not sure this is my problem but it looks like it is. I'll be reconfiguring tonight and know by tomorrow.

**NooNoo** · April 20th, 2004, 02:00 PM

good find!

**AlanCates** · April 20th, 2004, 09:47 PM

It is the NAT/Basic Firewall Dhcp Allocator that causes the problem. Shutting it down resolves the Event 1053's and the Dhcp service continues to run (now up for over 24 hours) and can be stoped and started at will.

It seems there is a reason only some people run into this problem and not others. It has to do with how one sets up RRAS. If one uses the Server Manager in SBS and has some knowledge of RRAS from other systems, they will miss configure nearly every time.

If one uses the RRAS console accessed from the Start/Admin Tools menu then they will correctly configure it. The basic properties for the RRAS service are not available via the Server Mgr. only the solo RRAS console.

**NooNoo** · April 21st, 2004, 01:23 AM

Thanks for the fix alan.

**rickrush** · October 31st, 2005, 10:27 AM

I am having this same issue. I noticed the post was old and didn't know if your fix had worked. If so, can you tell where you shut down the NAT/Basic Firewall DHCP Allocator?

Thanks,
Rick

**NooNoo** · October 31st, 2005, 05:50 PM

Welcome to Windrivers RickRush

Originally Posted by AlanCates

In System Manager one must drill down through Advanced Managment, RRAS to Nat/Firewall Properties and Address Assignment to shut off or reconfigure the assignment.