Unknown workgroup on the wire

This morning we had a workgroup show up under â??Microsoft Windows Networksâ??
with a very inappropriate name. I tried to access it from all subnets but was
unable to find it.

Any suggestions as another way to look for it or even better keep it from
happening.

Kent
Tue Mar 21 19:51:24 CST 2006

DonP wrote on 21-Mar-2006 10:44 AM:
> This morning we had a workgroup show up under â??Microsoft Windows Networksâ??
> with a very inappropriate name. I tried to access it from all subnets but was
> unable to find it.
>
> Any suggestions as another way to look for it or even better keep it from
> happening.
>
>
Don't let your users run with admin privilege.

--
Kent

DonP
Wed Mar 22 06:20:28 CST 2006



"Kent W. England" wrote:

> DonP wrote on 21-Mar-2006 10:44 AM:
> > This morning we had a workgroup show up under â??Microsoft Windows Networksâ??
> > with a very inappropriate name. I tried to access it from all subnets but was
> > unable to find it.
> >
> > Any suggestions as another way to look for it or even better keep it from
> > happening.
> >
> >
> Don't let your users run with admin privilege.
>
> --
> Kent
>

Thanks for the reply
We donâ??t usually. I do have to admit some times the techs will forget to
reset privileges. We have a lot of public labs and its possible some one
brought in a laptop. We need to locate the computer when a mistake is made.

Roger
Wed Mar 22 07:07:41 CST 2006

Find and tombstone the names in your WINS.
Using the IPs associated in WINS registrations you would
need to take the tracing over into your network/switches.

"DonP" <DonP@discussions.microsoft.com> wrote in message
news:A4727170-F9CB-4094-83A7-B230E6283B5C@microsoft.com...
>
>
> "Kent W. England" wrote:
>
>> DonP wrote on 21-Mar-2006 10:44 AM:
>> > This morning we had a workgroup show up under "Microsoft Windows
>> > Networks"
>> > with a very inappropriate name. I tried to access it from all subnets
>> > but was
>> > unable to find it.
>> >
>> > Any suggestions as another way to look for it or even better keep it
>> > from
>> > happening.
>> >
>> >
>> Don't let your users run with admin privilege.
>>
>> --
>> Kent
>>
>
> Thanks for the reply
> We don't usually. I do have to admit some times the techs will forget to
> reset privileges. We have a lot of public labs and its possible some one
> brought in a laptop. We need to locate the computer when a mistake is
> made.
>
>

DonP
Wed Mar 22 09:38:28 CST 2006

Thanks for the reply
Yes I found them in WINS. I will need to do a little rereading to â??refreshâ??
my memory on the tombstone part. But for now I can find the units and stop
the offensive names.


I never know if I should be at the top or bottom
Thanks again


"Roger Abell [MVP]" wrote:

> Find and tombstone the names in your WINS.
> Using the IPs associated in WINS registrations you would
> need to take the tracing over into your network/switches.
>
> "DonP" <DonP@discussions.microsoft.com> wrote in message
> news:A4727170-F9CB-4094-83A7-B230E6283B5C@microsoft.com...
> >
> >
> > "Kent W. England" wrote:
> >
> >> DonP wrote on 21-Mar-2006 10:44 AM:
> >> > This morning we had a workgroup show up under "Microsoft Windows
> >> > Networks"
> >> > with a very inappropriate name. I tried to access it from all subnets
> >> > but was
> >> > unable to find it.
> >> >
> >> > Any suggestions as another way to look for it or even better keep it
> >> > from
> >> > happening.
> >> >
> >> >
> >> Don't let your users run with admin privilege.
> >>
> >> --
> >> Kent
> >>
> >
> > Thanks for the reply
> > We don't usually. I do have to admit some times the techs will forget to
> > reset privileges. We have a lot of public labs and its possible some one
> > brought in a laptop. We need to locate the computer when a mistake is
> > made.
> >
> >
>
>
>

Steven
Wed Mar 22 15:19:15 CST 2006

Roger helped you track it down. As far as prevention you might want to look
at using mac filtering on your switches if they are capable to try and
prevent unauthorized computers on your network though it could be someone
with a legitimate computer if they have administrator access either
legitimately or not. A strict computer use policy with stated consequences
should also be implemented that prohibits such activity along with the
support of the higher ups to be serious about enforcing it. Unauthorized
computers can bring a whole list of problems to the network such as malware
and backdoors. -- Steve



"DonP" <DonP@discussions.microsoft.com> wrote in message
news:FB6D969B-E937-4D29-A5E8-B53C51FECBE8@microsoft.com...
> This morning we had a workgroup show up under "Microsoft Windows Networks"
> with a very inappropriate name. I tried to access it from all subnets but
> was
> unable to find it.
>
> Any suggestions as another way to look for it or even better keep it from
> happening.
>
>

DonP
Thu Mar 23 07:26:31 CST 2006

Thanks for your comments I may tape them up next to the printer. I will
follow up on your suggestions.

This Mend and Defend thing gets harder every year. A USER cannot install the
Adobe reader but Gator goes on and on.


"Steven L Umbach" wrote:

> Roger helped you track it down. As far as prevention you might want to look
> at using mac filtering on your switches if they are capable to try and
> prevent unauthorized computers on your network though it could be someone
> with a legitimate computer if they have administrator access either
> legitimately or not. A strict computer use policy with stated consequences
> should also be implemented that prohibits such activity along with the
> support of the higher ups to be serious about enforcing it. Unauthorized
> computers can bring a whole list of problems to the network such as malware
> and backdoors. -- Steve
>
>
>
> "DonP" <DonP@discussions.microsoft.com> wrote in message
> news:FB6D969B-E937-4D29-A5E8-B53C51FECBE8@microsoft.com...
> > This morning we had a workgroup show up under "Microsoft Windows Networks"
> > with a very inappropriate name. I tried to access it from all subnets but
> > was
> > unable to find it.
> >
> > Any suggestions as another way to look for it or even better keep it from
> > happening.
> >
> >
>
>
>