about 10 computers on network have had their DNS changed

sswats · 14 Feb 2012 at 11:47

Currently have about 20 PCs on a network here in the office.They all have deep freeze so technically all the settings should be the same. They're all on DHCP so are assigned an address by the router.

But after some started losing net connection I checked the properties of the network connection and they had had a an IP address and a DNS number inputted.

Any ideas how that could happen?

Sin_Chase · 14 Feb 2012 at 12:13

Circumvented the locks?
Does the lock software even work properly?
Logged in as local admin?
Changed via CLI with the netsh command?

sswats · 14 Feb 2012 at 12:54

I don't think it was done one by one basis.
Either through the network or through the internet.

Scanned individually for malware but nothing came up.

Banzai_Joe · 14 Feb 2012 at 12:57

sounds typically like a dns hijack, i've had it before, but a decent scanner found the malware.

sswats · 14 Feb 2012 at 13:12

which scanner did you use?

And hwo did it get on multiple systems pretty much at the same time?

PistolPete · 14 Feb 2012 at 13:50

What IP range and DNS servers were set??

Zarf · 14 Feb 2012 at 19:27

Sounds to me like a case of Users. Someone was probably late on a project or just wanted the morning off so they played silly buggers with the network settings on a few PC's then loudly complained about not being able to get any work done because the "network was down". That or they were trying to circumvent some net filtering.

Lock that **** down with group policies.

NathanE · 14 Feb 2012 at 19:45

This is why your firewall should only allow outbound UDP port 53 to your trusted DNS servers. E.g. Allow UDP 53 to 8.8.8.8, Deny UDP 53 to *.

Deception · 14 Feb 2012 at 21:20

PistolPete said:
What IP range and DNS servers were set??

This. Was it just random IP and DNS or a specific one?

Chief Wiggum · 15 Feb 2012 at 06:26

Has anyone plugged a router in? This could be giving out ip addresses with different DNS settings? We've seen that before when someone wants to have wireless access in their office.