PLEASE SAVE MY NEW JOB!!!!

FrankJH

FrankJH

FrankJH

Soldato
Joined
6 Jun 2005
Posts
22,598
Right before I start I want to stress that I dont believe I am breaking any rules with this thread, but sincere appologies if this is the case.

Right I have recently started a new job in the City for a small hedgefund (share dealers) in the IT department desktop / server support. Everything was going well for the first two weeks or so but then something happened yesterday..........

A stock market researcher came in complaining (nicely) that he had limited network availability, he was logged in to XP Pro but couldnt get internet or browse any local servers. Discovered that somehow overnight another machine had nabbed his IP, so i thought no problem " cmd & ipconfig/ release and then renew" however this only resulted in nothing changing ( ip add of 0.0.0.0)

so My next thought was ok, if I take him off the network and put him in a workgroup, and then re-add him that should assign him a new ip

Put in standard Netowrk admin username and password for the company, and that happily got him into the "workgroup" rebooted as required by windows and now cant log in at all ( no machine name / network name box on log in screen) normal user {who i believe IS a local admin} details, admin username and password all fail to get to the desktop ( password / username not accepted)

I have tried dameware and remote desktop connection and Computer Management snap in module - all of which deny that the machine name of this pc is reachable, even though first thing I physically checked and have at numerous intervals since, there is activity on the netowrk card.

Wont boot from usb key and tried booting to dos and using "PsPasswd" to rename Admin account but even though dos claimed this worked it had no affect.

Any ideas at all would be great - my colleagues have also run out of ideas and dont know of any other usernames or passwords that would have been used to install the OS other than the one I initally tried.

OK the thread title maybe a little dramatic lol, but I fel bad for not solving this.
 
Have you tried logging in locally? Rather than to a domain or workgroup.

Is the network card onboard? If so, disable it in BIOS and put a PCI one in and see what happens. Start windows in safe mode to see if you can edit the local accounts there after loggin in locally.
 
Matt-Page said:
Have you tried logging in locally? Rather than to a domain or workgroup.

Is the network card onboard? If so, disable it in BIOS and put a PCI one in and see what happens. Start windows in safe mode to see if you can edit the local accounts there after loggin in locally.
Click to expand...


No one can log in locally - we have tried the day to day user details, the "normal" admin/ blank password, also the netowrk admin details but logging into workgroup (local machine) all to no avail

Netowrk card is onboard, i have been rummaging thru old pc's here but all seem to have onboard cards also - will keep looking just incase though.

All varieties of safe mode ask us to log in first - highly frustrating I have to admit, I always thought basic safe mode went straight to desktop but not in this case
 
What do you think to this plan?

If I find a similar style /model of pc from our unused pile and change over the hdd from the "locked out" unit, this should hopefully force an IP change so that I can actually see it on the network and hopefully remote in?
 
FrankJH said:
so My next thought was ok, if I take him off the network and put him in a workgroup, and then re-add him that should assign him a new ip
Click to expand...
Where did you get that idea from? DHCP knows no authentication.

FrankJH said:
I have tried dameware and remote desktop connection and Computer Management snap in module - all of which deny that the machine name of this pc is reachable, even though first thing I physically checked and have at numerous intervals since, there is activity on the netowrk card.
Click to expand...
Just because the link is up, doesn't mean you can reach it.

Try using the Ultimate Boot CD for the password reset. People have mad much success with it.

As for the network issue, assuming that your other clients are getting an address ok (do a /release /renew on another machine to check this. Dont rely on the fact they are just working, they all have DHCP leases remember), then either Windows is very unhappy (TCP/IP driver disabled or corrupted perhaps), or the NIC is faulty.

Do you have a Linux Live CD handy (essential tool for the admin 'swiss army knife)? Try and boot something else that would bring up the network and see what happens.
 
OK, take a step back and think......you have a machine that cannot get a DHCP lease because someone has nabbed its IP address statically and you're wondering why remote admin tools aren't working? :)

The option of booting into safe mode sounds like a good idea, but wouldnt it be easier (for both you and the user) to get hold of the machines MAC address and re-register with a new IP on your DHCP server?

Also unplugging the network cable in safe mode wont make a difference either way, as the default safe mode doesnt actually load any network drivers.

Of course once you give the person a new IP address and they get it via DHCP you can have the fun task of hunting down the blighter who pinched it, though depending on your network setup you (i.e. your networking bods) can interrogate the routers, get the ARP history for that IP and even isolate the MAC address of the machine, when it was on the network and what socket it was plugged into! (although you can get some of this from your dhcp server directly)
 
M0KUJ1N said:
OK, take a step back and think......you have a machine that cannot get a DHCP lease because someone has nabbed its IP address statically and you're wondering why remote admin tools aren't working? :)

The option of booting into safe mode sounds like a good idea, but wouldnt it be easier (for both you and the user) to get hold of the machines MAC address and re-register with a new IP on your DHCP server?

Also unplugging the network cable in safe mode wont make a difference either way, as the default safe mode doesnt actually load any network drivers.

Of course once you give the person a new IP address and they get it via DHCP you can have the fun task of hunting down the blighter who pinched it, though depending on your network setup you (i.e. your networking bods) can interrogate the routers, get the ARP history for that IP and even isolate the MAC address of the machine, when it was on the network and what socket it was plugged into! (although you can get some of this from your dhcp server directly)
Click to expand...

Just burning a Ultimate Boot Cd after a very hectic morning fire fighting.

Maybe I was wrong, but I was under the impression that taking the machine off the netowrk and onto a workgroup and then re-adding to netowrk did exactly as you suggest - reregistering MAC add on the DHCP ( sorry Otacon yur right , but I have done this in the past and its solved IP conflicts - but described it wrong in initial post)

Anyway just wrestled the ISO onto a blank cd and hoping this will work
 
I am being stupid - I thougth an ISO should be burnt straight to CD, I know Nero etc have "make bootable" option but how about using standard Windows XP's inbuilt burner?

The ISO wouldnt d/l from Planet Mirror so I grabbed the self extracting exe instead. Even after looking at extracted files from ISO (using WinImage) nothign aprticular looks bootable..... argggg got brain fade
 
you have to use the "burn image" option in Nero, Roxio etc. You shouldnt have to worry about setting up as a bootable CD etc as the ISO image is essentially a direct binary copy of the original disc, therefore that info is built into the ISO itself :).
If you want a free alternative CDBurnerXP is your best bet (and one I have used in the past) although I have heard good things about ImgBurn too.
 
Have you asked anyone if there is a Group Policy which prevents local logons or other restrictions as if so that is part of your problem.

You need to find out why it does not logon locally before trying a rebuild which should be a last resort.

I suspect it could also be related to maybe the AV software is out of date and some server on the network is denying access for that host name.
 
Definitely not a group policy - I have logged into PCs locally a few times- so it was a good idea about policy's but not applicable

Its not logging on because no one knows the local admin username/password combo from when machine was built

AV software was fully upto date - its forced out by server on an auto update whenever there is a release

MOKUJIN - I am glad I wasnt going crazy and thinking that the ISO should be a direct burn, but this is exactly what I did within Windows own cd burner, and even after double checking BIOS is set to boot from CD first, My machine ( used as a test for the cd booting purposes) ignored the cd - the light went on so it was accessed, but then went on to hdd. CD is readable ( thru windows explorer)

the self extracting EXE>>>ISO is about same size ( 110mb) as the download which wasnt working earlier - so at least thats a step forward. What ever I do this ISO isnt seemingly bootable even though its a "good" burn

Quick update -- cd is being accessed , I get the dos cursor when its reading the cd ( instead of going straight to the XP loading screen) for about 10 seconds, and then it proceeeds to laod WinXP as normal
 
Last edited:
Thats not very helpful is it, although your point may be justified there are always some things that can confuse the hell out of people, as is the nature of PC's the problem may not be what everyone suspects, I work with loads of top IT guys and there are somethings that even they scratch their heads at.

Why not post something constructive.
 
what you should have done from the start, check the firewall on the pc, add a static ip 1st then try to ping the gc and gw, if you cant look at the cat cable se if it is connected to the port next swap cables if that dont work swap ports, ( use a port from another pc that can get a dhcp addy), also check the system log on the client pc, check events on the dhcp.

http://support.microsoft.com/?kbid=896062&SD=tech


ping 127.0.0.1 if it dosent work then its

The TCP drivers are corrupted.
The network adapter is not working.
Another service is interfering with IP

READ THIS
http://www.netswitcher.com/Support/...shoot TCP_IP connectivity with Windows XP.pdf
 
Last edited:
No firewall active on pc - and no upgrade that could have potentially turned it on ( we have hardware firewalls in server room, so dont require any "windows" ones - and this even interferes with some apps we use anyway.

Unfortunately there was no other port to use, so that wasnt really an option.

I couldnt ping the DC ( dont know what a gc is, and guessing the gw is gateway?)

We came to the conclusion that the mobo inbuilt netowrk adaptor was failing for some reason ( it was a pretty ancient compaq EN machine)

My boss came in late with a bootable piece of software called "EFN" or something similar - will update on Monday when I copy it lol - but it was an XP shell basically with a "Locksmith" program available

The Admin account name had been changed to someone's name ( who had left the company yearsss ago) and no one on the IT team had even met or knew about the username / password - so first thing I did was change name to something more suitable

Still want to work out why XP wont burn a proper copy of the Ultimate Boot CD ISO, it literally just burns the ISO itself ( ie in explorer you see one ISO file rather than all the files it should contain)

Thank you everyone for all your assistance - not really sure why I deserved the remarks that have been edited out but hey ho
 
One thing to check first in the future, its always worth using your cable tester on the network cable, weird things can happen when a couple of pins are out on a 100mb network.

Edit-In fact i would put money on it being the cable.
 
Last edited:
masterk said:
One thing to check first in the future, its always worth using your cable tester on the network cable, weird things can happen when a couple of pins are out on a 100mb network.
Click to expand...

Very true - just surprising it happened over night with no justification but your comment is taken onboard. Thank you
 
You must log in or register to reply here.
Back
Top Bottom