1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Event ID 1007 DHCP Server

Discussion in 'Networking' started by ragingmoon, May 24, 2010.

Thread Status:
Not open for further replies.
Advertisement
  1. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    I am receiving event id 1007 from source DHCP on my Domain Controller which is causing loss of routing and access to network resources. From initial research it appears to be caused by one of the network cards receiving an auto configuration IP address in the 169.254 range. This is causing users to lose access to the Internet, which is not good. :mad:

    Anyone any ideas what could be causing this? It has only recently started happening. The DHCP range has 31% free so it should not be due to IP address conflicts?

    Grateful for advice if anyone has come across this.
     
  2. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    The event ID is basically a confirmation that it has received a 169.254.xxx.xxx address. This address is assigned in the event the client cannot find the DHCP server.

    Have there been any changes to your server recently (it could be within the last couple of days, depending on how long your DHCP leases are)? There are multiple things that can cause this, such as changes to the scope or loss of connectivity to the server.

    Are you getting this error on your DC? Is your DC set up to pull an address from the DHCP server? You may want to check all network connections and disable any adapters that are in use and verify your connection settings.
     
  3. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    No changes to the server recently. When it happens the DHCP server, which sits on the DC is not connected. I don't know why the DHCP server is disconnecting.
     
  4. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    It sounds like the DHCP service is shutting down. Are there any other related entries in the event log?

    How many client computer are affected by this? Also, are there any errors or messages when you connect to the DHCP server after opening up the DHCP window?
     
  5. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    That is my suspicions also. No other related events under the system log. For a while I was getting events saying that there were only 9 IP addresses left in the scope. I have also had a few cases of IP conflicts. It is two weeks in a row that we have lost Internet connectivity at exactly the same time on a Monday morning which makes me think it is the week's IP address lease that is expiring and then it can't assign new addresses. When I open the DHCP window during the outage the top of the DHCP tree says not connected. I got it working again by asking users to shutdown their pc's and I then reboot the server.

    If I could find out the reason why the DHCP services are stopping I would be able to take remedial action. Grateful for any further advice you may be able to offer. (y)
     
  6. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    I should add there are upwards of 65 client computers affected. The scope is set to 100 devices.
     
  7. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    Interesting. Just a shot in the dark here, but do you have your DC's IP address listed in an exclusion? It almost sounds like DHCP is assigning the IP address of the server, causing a conflict, and knocking both computers off the network.
     
  8. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    Not sure what you mean by exclusion mate but the network subnets are all open on the firewall and this subnet that is going down is the client one. As I do further research I am also seeing the possibility that it could be an infected machine on the network. Hard to troubleshoot as something is knocking the DHCP server out and at this point I know not what.
     
  9. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    Exclusions allow you to configure a particular IP address (such as your DHCP server itself) from being included in the range of available IP addresses that are assigned to clients. If you haven't already, you really should create exclusions for the important things on your network, such as the IP address of your firewall/router and your server(s).

    If your DHCP server is assigning it's own IP address to a client, this would cause an IP conflict and show the symptoms you are describing. You can see which exclusions are currently set up (and assign a new exclusion, if necessary) using the DHCP MMC. Click on "Address Pool" to see a list of exclusions and right-click "Address Pool" to add a new exclusion.

    See the screenshot below:

    [​IMG]
     
  10. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    Thanks. Yes, I see what you mean now. Yes, pretty sure exclusions are already set up so that none of the network devices IP addresses are open to clients. Will check tomorrow though. This is a system I inherited and it was running fine up until about two months ago when we started having these network resource outages. I initially thought it was the ISP and then our aging Cisco Pix 515e Firewall. Now that I have finally identified the DHCP server as the cause I hope to be able to resolve the problems without resorting to calling Microsoft.
     
  11. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    Just to confirm - the EventID 1007 is showing up on your server, correct? If so, this indicates your server is asking itself for an IP address. Have you verified that all network adapters are set to static IPs and the IPs are valid?
     
  12. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    Yes it is on the server mate. This server is the DC, the AD, the DHCP and the DNS server. No, I haven't done that bud. Will have a look at that tomorrow/today :) Why would this suddenly become an issue though when nothing has changed on the server config wise for up to 5 years. :confused:
     
  13. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    It is possible that a Windows Update made the change, or someone installed some software on the server, or a virus, or someone accidentally hit the wrong key while they we doing something else. There are a number of different possibilities as to what happened.

    I remember an issue we had with DHCP that somehow reset the lease time from 8 days to 8 hours. This played havoc on our LANDesk (remote control/inventory management software) and was a nightmare to try to get back to normal. We never did figure out what caused the change, whether it was an update or a fat finger. :p
     
  14. ragingmoon

    ragingmoon Thread Starter

    Joined:
    Jan 27, 2008
    Messages:
    107
    The scope has 100 addresses to lease. The lease time was set for 8 days. No exclusion zones but the network card on the server has a static IP within the scope range. Anti virus on server shows nil found.

    In the DHCP 1007 event the MAC address it is saying that has been configured with the 169.254.**.*** address is one of the network cards on the server that has the network cable unplugged. :confused: Should I disable that connection? I also increased the lease time of the scope to see if that coincides with the next network outage. Nobody works on this server bar me and I don't have fat fingers. I have piano playing hands. :D
     
  15. digitalsatori

    digitalsatori

    Joined:
    Apr 27, 2010
    Messages:
    162
    There are no exclusions set up and the IP address of your server is within the scope range? I think this may explain it. If your static IP address is within the range of the DHCP scope, your DHCP server is assigning your server's IP address to a client. This causes an IP conflict and will disconnect your server and the client computer.

    To resolve this, you will need to create an exclusion for your server's IP address. Additionally, you will want to create exclusions for any statically assigned devices (such as routers, printers, servers, etc.) to prevent IP conflicts from occuring.

    As far as the MAC address appearing in the event log, my suspicion is that when the conflict occurs, the server attempts to reconnect using the other NIC (since your current NIC is considered to be "offline" during an IP conflict) - because it is disconnected and cannot find a DHCP server, it assigns the 169.xxx.xxx.xxx address, which is standard practice for DHCP.

    Once you add the exclusions, I suspect this will resolve your issue.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/924988

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice