Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer "Ghosting" on the network


  • Please log in to reply
4 replies to this topic

#1 wing987

wing987

  • Members
  • 177 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Payette, ID
  • Local time:06:42 PM

Posted 22 November 2013 - 12:20 PM

     I have a computer on an enterprise environment that seems to not exist.  This system is online with full network resources. However the device is not detected from a remote location via ping.  There is no response. It acts like a firewall on cthe local computer, but there is none running. Here are the steps taken, not in any specific order.

 

from problem device via screen share over OCS:

1) ping 127.0.0.1, good

2) ping local server, good

3) ping 8.8.8.8, good

4) ping remote IT computer, good

5) check windows firewall, disabled (this is what I want)

6) start windows firewall, fail

7) start windows firewall service, fail

8) run "unhide" to ensure recent viral activity in regitry is reset (i know it will not do it all), nothing found

9) ensure there is no other software firewall on device, good

10) remove software not needed, no change

11) multiple restarts after each change, no change

12) release and renew IP, no change

13) gp update, no change

 

from remote devices:

1) ping device, fail

2) ping server on local network, good

3) ping device from another physical location, fail

4) ping device from server on local network, fail

5) check dhcp lease, exists

6) remove dhcp lease, new one obtained, still cannot ping

7) try to push updates, computer not found

8) try to scan device, computer not found

 

Anyone have any more ideas?


Edited by hamluis, 26 November 2013 - 06:46 AM.
Moved from Win 7 to Networking - Hamluis.

-- Windows 7 Ultimate on custom built system, Windows 10 on under powered laptop. Sophos UTM 9, Ubuntu Server and Windows Server 2008 R2. HyperV Virtualization --

 

"The hottest places in hell are reserved for those who in a period of moral crisis maintain their neutrality," John F. Kennedy


BC AdBot (Login to Remove)

 


#2 Kilroy

Kilroy

  • BC Advisor
  • 3,324 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Launderdale, MN
  • Local time:07:42 PM

Posted 22 November 2013 - 02:16 PM

VPN software?



#3 wing987

wing987
  • Topic Starter

  • Members
  • 177 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Payette, ID
  • Local time:06:42 PM

Posted 22 November 2013 - 02:37 PM

I suspected that, but the device is a desktop located on site, no vpn needed or installed (and I did double check)


-- Windows 7 Ultimate on custom built system, Windows 10 on under powered laptop. Sophos UTM 9, Ubuntu Server and Windows Server 2008 R2. HyperV Virtualization --

 

"The hottest places in hell are reserved for those who in a period of moral crisis maintain their neutrality," John F. Kennedy


#4 wing987

wing987
  • Topic Starter

  • Members
  • 177 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Payette, ID
  • Local time:06:42 PM

Posted 22 November 2013 - 02:39 PM

Update:

 

Tried a few more things....ensured terminal services was running (Remote Desktop Services really since it is Win7), netstat shows TCP 3389 is listening, but showing IP 0.0.0.0


-- Windows 7 Ultimate on custom built system, Windows 10 on under powered laptop. Sophos UTM 9, Ubuntu Server and Windows Server 2008 R2. HyperV Virtualization --

 

"The hottest places in hell are reserved for those who in a period of moral crisis maintain their neutrality," John F. Kennedy


#5 technonymous

technonymous

  • Members
  • 2,474 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:42 PM

Posted 07 December 2013 - 10:06 PM

Some device trying to get an ip by the sounds of it. Maybe a rogue ap, tablet, maybe a VM that hasn't shutdown but is hybernating being ran from one of the other machines? Just throwing some idea's out there.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users