Ok.. Now when the users log ontothe domain they are getting wrong ip's given to them, the scope in the dhcp is 192.168.2.XXX, now when the users log on they get 192.168.0.XXX and this happens randomly to random users when logging on.I have checked a few setting and "default"values and settings with in the scope in thedhcp server and every thing looks good.Any Ideas where to look ?ThanksI forgot to mention doing ipconfig /release & /renew fixes the issue, and connects them to exchange and network drives after. But it happens every time randomly when users log on to the domain, for the past 2 daysOn a side note for anyone who may read or is curious, I lost power several times from Hurricane Ike and for some reason now I get the following errors in the event viewer Event Type:ErrorEvent Source:LicenseServiceEvent Category:NoneEvent ID:202Date:9/17/2008Time:1:14:10 AMUser:N/AComputer:MASTERDescription:The product Windows Server is out of licenses. Use Licensing from the Administrative Tools folder for more information on which users are out of compliance and how many licenses should be purchased. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Every time users try to login the event log kicks out the above error, Now I have looked at the Licensing app and I see the clients are not in violation but the windows server is and all of our licenses are not showing in the purchased section..(Root CA is good) not sure if this is even related but something for some one to mull on, I am knee deep in it here and from the generic looks of things everything appears to be "working as intended"Semi Edit, I am curious what could cause the cal's we bought to completly dissapear, and with the server that when't offline being our primary DC, I figured being off line it would be demoted but that wasn't the case, so.. being a memeber server the error the cal's bought for this server the DC should still show in the purchased licenses?, there is nothing liosted under purchased, it's almost as if this is a fresh dc added to the domain with the licensing running from it but no licenses purchased.. confusing to say the least.

Have you checked your firewall configs? Perhaps in your networks firewall there is also an DCHP server which gives IP's to machines. You mentioned about power loss. What if some other network device have changed itself to some "default mode" where the DHCP servers are enabled?So after being sure the DHCP server itself does not cause this, the checklist would be1. Firewall2. Other network devices3. Users :) I once had one user that had enabled own DHCP in my network. People do wild stuff, if they can :)Henry Eklf :: Just one random IT-guy more.

Humm, good idea, i'll check the firewal, also the DHCP is running on the master server (DC) which failed, and is also the DNS serverOnly other server that failed was the fileserver (backup) but I restored the raid 5 and data.All systems are set to obtain I checked a few times, now what is intresting is I have narrowed it down to 10 users that allways get a bad ip when logging onto the domain, and the same users including myself are in the cal listof users violating.. somthing to chew on, ill post the router/firewall results.

Fix my licensing issues, Now the ip error still remains...Some info that is interesting whenI pull and ipconfig /all on the bad ip'sMy firewall is configured correct, DHCP service enabled, DHCP specified (runs on the DC master)DNS suffix: *blank*NIC: Broadcom so on so forth, all good info.Gateway 192.168.0.1DHCP 192.168.0.1DNS 192.168.0.1No wins server listed, *no device/server has ever had 192.168.0.xxx on our network*It seems to be narrowed down to 12 users tops, and no one else on the network. or more so there pc's and laptops, my question would be, can the mac address be bad or seen as bad?

Must be a rogue DHCP server. You can use the DHCPLOC resource kit tool (http://technet.microsoft.com/en-us/library/cc778483.aspx). Alternatively, you can use DHCP Sentry or dhcp_probe to detect a rogue DHCP server.A detailed how-to can be found here:http://searchsecurity.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid14_gci1174495,00.htmlSalvador Manaois III MCITP | Enterprise/Server Admin Bytes & Badz :http://badzmanaois.blogspot.com

I was thinking along the same lines after mnay many hours, and if my thinking is on the right lines, it's pointing to either the logon server on the DC, or Browse master..

Still no joy, on what seems to rapidly be turning into a nightmare....No rogue DHCP, Switches all good, Router all good, Clients all good.. I have found several issues and resolved problems I didn't even know where there looking for a solution to this, and.. (I laugh but not in Joy) I found my back up server dc is now having cert issues..192.168.0.1 seems to be my nemesis at the moment, I am unable to find what is issuing these ip's to users (192.168.0.100-155) I am totaly baffled..my support call to microsoft was not that great either almost $300 down the drain.. only solution i can come up with is to reinstall the DHCp server on a fresh server, which I feel is a bad solution as to who knows this may appear again...Well if anyone EVER finds them selfs stuck in this situation and resolved it, i read the posts daily and would be more than "over joyed" if an answer was found..a.f

I have finaly resolved the issue, after some helpfull advie fromSalvador Manaois IIII did find a D-link router attached to the network which was put there buy someone else after Hurricane Ike, and was configured for dhcp, so when I lost power to our dhcp server basicly everything was pointing to this router for an ip.. man.. x4 14 hour days to fix this issue was NOT fun, we have 26 d-link products on our network just to help WAP and drops.. not fun...dhcploc -p "your ip" "dhcp ip" <-- this tool isVERY handy, thenI used CC get mac address 2.2 (http://www.youngzsoft.net/cc-get-mac-address/) and then shut down one by one the d-links till I found the rogue, but also connecting through a d-link WAP also gave me the log in screen for the rogue d-link by it's model ID which saved me around 2 days, all i did then was to walk around look at the ID and bingo. Result, was a bad power supply faultering device, removed, and it appears that the DHCP server running fine.Thanks again to those who postedA.F