Hi All, I have Windows 2008 server as a file server. When I went to Computer management > Shared Folders >Sessions for checking who login the file server and open the files which on the file server, there list username and computer name, I noticed that one user who connect to the file server from a stranger computer name. In our company LAN, we don't have the computer name. I know that the user just only use her own computer. Her own computer name is rknj.domain.com, but the computer name shows on the file server is rpnj.domain.com. Is any know how the computer name came from? How I check where is the computer? Thanks in advance.

Can’t you ping the computer name and get the IP address? Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX http://blogs.sivarajan.com/ http://publications.sivarajan.com/ This posting is provided "AS IS" with no warranties, and confers no rights.

I tried Ping rpnj.domain.com, it shows: Ping request could not find host rpnj.domain.com. Please check name and try again. Thanks

if you cannot ping, search for the ip with nslookup. if you cannot find it there it's not registered in dns. if you think you have a rogue computer disable it. Roy Mayo | MCSE

Hi learnstudy, Thanks for post here. Here are some utilities could you to isolate this issue. If the suspect computer is accessing your shared folder, you may like to perform “nbtstat -ano” ,it will list protocol statistics and current TCP/IP connections of your server , and you need notice the Foreign Address which related with your local 445 port .After that please perform “ARP –a” to list the ARP table ,so that you can isolate the MAC address of suspect computer. In that case , you can locate the computer with check the MAC table on your switch. Netstat http://technet.microsoft.com/en-us/library/cc940097.aspx Arp http://technet.microsoft.com/en-us/library/bb490864.aspx Hope that’s helpful Tiger LiPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Roy, I tried nslookup It shows " domain.com can't find rpnj11.domain.com: Non-existent domain. I don't think that we have the computer on our LAN. Would you please let me know how I coudl disable it? thanks a lot.

use AD Users and Computers, rt click on the domain, find, select computers in the Find pull down box, type the computer name and Find Now, rt click on the computer object and Disable Roy Mayo | MCSE

Hi Li, Thank you so much for your help. On the file server, I run "netstat -a", It shows local: 139 port, and foreign address: rpnj11:2624. And I run "ARP -a", I got the IP address and MAC address. The IP address and MAC address is for rknj11, which is my user's own computer name. And on the connection session, it shows that the user open the file. I don't know why it shows rpnj11. It should be shown rknj11. And I don't know how the server get the error computer name and how to fix the problem. Do you know how to fix the problem? Thanks a lot.

Hi Roy, I tried to run nslookup. I found out the following: 1, run nslookup rpnj11.domain.com, it shows "Cannot found rpnj11.domain.com, No-Existent domain." 2, run nslookup rknj11.domain.com (correct computer name), it shows: Name: rknj11.domain.com, Address: xxx.xxx.xxx.xxx (correct IP address) 3. run nslookup xxx.xxx.xxx.xxx (correct IP address), it shows: Name: rpnj11.domain.com, Address: xxx.xxx.xxx.xxx (correct IP address). Do you know why it happenned? Thanks a lot.

use the dns management console and see if there are two A records for the IP. if so, delete the one for rpnj11. if you have other dns servers the change may take a while to replicate or transfer. ipconfig/ flushdns on the computer you are running nslookup. try nslookup again. Roy Mayo | MCSE

Hi Roy, Thank you so much for your help. I went AD Users and Computers, type rpnj11 (wrong computer name) > Find now, It shows No itmes match the current search. What I should do next? thanks

look for and delete the dns record for rpnj11 if it exists. see last postRoy Mayo | MCSE

Hi Roy, thanks, I didn't use DNS manaement console before. Can you show me how to open DNS managment console and how to check A record for the IP? Thanks a lot.

Hi, To open the DNS snap-in, click Start, point to Administrative Tools, and then click DNS on DNS server or Perform “ dnsmgmt.msc ” could open DNS console . I suspect that there is a wrong PTR record named "rpnj11" in the reverse lookup zone . Open DNS console/ <Server name>/ Reverse Lookup Zone/**.**.**. in-addr.arpa Check if there is a record “rpnj11” ,if yes,please delete it and perform "ipconfig /registerdns" on host rknj11 to re-register this record. Managing DNS http://technet.microsoft.com/en-us/library/bb727018.aspx Thanks. Tiger Li Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Li, Thank you so much for your help. Your answer helps me to fix my problem. Thanks again.