Computers Return from the Dead

Hi,

In my recent Extended Server Usage Report, under the Web Activity by
Computer section, I see two computers that are no longer on the domain, (they
don't even exist any more!), AND they seem to have 24hr/day web activity.

I checked with Manage Computers on the SBS machine (standard version, 2003)
and confirmed that these two machines are not on the network. How then does
the server usage report still show them, and show them as being active?

Thanks,

- Pasta

Larry
Mon May 05 09:40:49 PDT 2008

Hi Pasta:

Like your subject line.

First thing one has to ask is if the computers in question were removed from
the domain with the remove computer wizard in Server Management?

--
Larry

Please post the resolution to
your issue so that all can benefit.


"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> Hi,
>
> In my recent Extended Server Usage Report, under the Web Activity by
> Computer section, I see two computers that are no longer on the domain,
> (they
> don't even exist any more!), AND they seem to have 24hr/day web activity.
>
> I checked with Manage Computers on the SBS machine (standard version,
> 2003)
> and confirmed that these two machines are not on the network. How then
> does
> the server usage report still show them, and show them as being active?
>
> Thanks,
>
> - Pasta

Cliff
Mon May 05 09:59:39 PDT 2008

If the computers weren't removed properly then it is possible that your DNS
is out of sync with the rest of the system. Check your reverse DNS records
and see if there are ptr records for the old machines. It is possible that
new machines now have those old IP addresses and thus causing problems.

Try out the SBS BPA, it tends to spot some problems like this.

-Cliff


"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> Hi,
>
> In my recent Extended Server Usage Report, under the Web Activity by
> Computer section, I see two computers that are no longer on the domain,
> (they
> don't even exist any more!), AND they seem to have 24hr/day web activity.
>
> I checked with Manage Computers on the SBS machine (standard version,
> 2003)
> and confirmed that these two machines are not on the network. How then
> does
> the server usage report still show them, and show them as being active?
>
> Thanks,
>
> - Pasta

kj
Mon May 05 10:06:29 PDT 2008

Psychopasta wrote:
> Hi,
>
> In my recent Extended Server Usage Report, under the Web Activity by
> Computer section, I see two computers that are no longer on the
> domain, (they don't even exist any more!), AND they seem to have
> 24hr/day web activity.
>
> I checked with Manage Computers on the SBS machine (standard version,
> 2003) and confirmed that these two machines are not on the network.
> How then does the server usage report still show them, and show them
> as being active?
>
> Thanks,
>
> - Pasta

Probably stale DNS records. DNS doesn't have ageing (scavanging) turned on
by default. WINS records should be aged out though.

Trying pinging the computers by name and see if the real ones don't respond.

--
/kj

Psychopasta
Mon May 05 14:46:04 PDT 2008

Hey Cliff, Larry and kj,

Thanks for the replies! Let me reply to all three at once...

Pinging the dead by name doesn't help: I just get told that the ping request
could not find host xxxx.

I removed the machine via the remove computers wizard, yep.

How do I check reverse DNS, and what is the SBS BPA?

Thanks again,

- Pasta

"Cliff Galiher" wrote:

> If the computers weren't removed properly then it is possible that your DNS
> is out of sync with the rest of the system. Check your reverse DNS records
> and see if there are ptr records for the old machines. It is possible that
> new machines now have those old IP addresses and thus causing problems.
>
> Try out the SBS BPA, it tends to spot some problems like this.
>
> -Cliff
>
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> > Hi,
> >
> > In my recent Extended Server Usage Report, under the Web Activity by
> > Computer section, I see two computers that are no longer on the domain,
> > (they
> > don't even exist any more!), AND they seem to have 24hr/day web activity.
> >
> > I checked with Manage Computers on the SBS machine (standard version,
> > 2003)
> > and confirmed that these two machines are not on the network. How then
> > does
> > the server usage report still show them, and show them as being active?
> >
> > Thanks,
> >
> > - Pasta
>
>

Larry
Mon May 05 15:24:27 PDT 2008

www.sbsbpa.com

do what ever it tells you.

from the server try:

start - run - cmd

in the cmd (dos) box that opens type

ipconfig /flushdns
then
ipconfig /registerdns

then check again.

--
Larry

Please post the resolution to
your issue so that all can benefit.


"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:C4601FDC-2A17-4D9E-AA2B-BE73B5F8C038@microsoft.com...
> Hey Cliff, Larry and kj,
>
> Thanks for the replies! Let me reply to all three at once...
>
> Pinging the dead by name doesn't help: I just get told that the ping
> request
> could not find host xxxx.
>
> I removed the machine via the remove computers wizard, yep.
>
> How do I check reverse DNS, and what is the SBS BPA?
>
> Thanks again,
>
> - Pasta
>
> "Cliff Galiher" wrote:
>
>> If the computers weren't removed properly then it is possible that your
>> DNS
>> is out of sync with the rest of the system. Check your reverse DNS
>> records
>> and see if there are ptr records for the old machines. It is possible
>> that
>> new machines now have those old IP addresses and thus causing problems.
>>
>> Try out the SBS BPA, it tends to spot some problems like this.
>>
>> -Cliff
>>
>>
>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> > Hi,
>> >
>> > In my recent Extended Server Usage Report, under the Web Activity by
>> > Computer section, I see two computers that are no longer on the domain,
>> > (they
>> > don't even exist any more!), AND they seem to have 24hr/day web
>> > activity.
>> >
>> > I checked with Manage Computers on the SBS machine (standard version,
>> > 2003)
>> > and confirmed that these two machines are not on the network. How then
>> > does
>> > the server usage report still show them, and show them as being active?
>> >
>> > Thanks,
>> >
>> > - Pasta
>>
>>

SuperGumby
Mon May 05 15:40:19 PDT 2008

Though other chat is relevent I'm interested in the status of these 'dead'
PC's. Have they been destroyed (wiped) or have they been given away and are
possibly still running the original install?

"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> Hi,
>
> In my recent Extended Server Usage Report, under the Web Activity by
> Computer section, I see two computers that are no longer on the domain,
> (they
> don't even exist any more!), AND they seem to have 24hr/day web activity.
>
> I checked with Manage Computers on the SBS machine (standard version,
> 2003)
> and confirmed that these two machines are not on the network. How then
> does
> the server usage report still show them, and show them as being active?
>
> Thanks,
>
> - Pasta

Psychopasta
Mon May 05 16:38:01 PDT 2008

Hey Larry,

That sbsbpa is cool! Thanks.

I've followed all its advice, and yours too, but how do I know if its made a
difference? I only get the Extended Server Usage Report every two weeks, so
do I need to wait until then to see if the dead are still walking?

- Pasta


"Larry Struckmeyer [SBS-MVP]" wrote:

> www.sbsbpa.com
>
> do what ever it tells you.
>
> from the server try:
>
> start - run - cmd
>
> in the cmd (dos) box that opens type
>
> ipconfig /flushdns
> then
> ipconfig /registerdns
>
> then check again.
>
> --
> Larry
>
> Please post the resolution to
> your issue so that all can benefit.
>
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:C4601FDC-2A17-4D9E-AA2B-BE73B5F8C038@microsoft.com...
> > Hey Cliff, Larry and kj,
> >
> > Thanks for the replies! Let me reply to all three at once...
> >
> > Pinging the dead by name doesn't help: I just get told that the ping
> > request
> > could not find host xxxx.
> >
> > I removed the machine via the remove computers wizard, yep.
> >
> > How do I check reverse DNS, and what is the SBS BPA?
> >
> > Thanks again,
> >
> > - Pasta
> >
> > "Cliff Galiher" wrote:
> >
> >> If the computers weren't removed properly then it is possible that your
> >> DNS
> >> is out of sync with the rest of the system. Check your reverse DNS
> >> records
> >> and see if there are ptr records for the old machines. It is possible
> >> that
> >> new machines now have those old IP addresses and thus causing problems.
> >>
> >> Try out the SBS BPA, it tends to spot some problems like this.
> >>
> >> -Cliff
> >>
> >>
> >> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> >> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> >> > Hi,
> >> >
> >> > In my recent Extended Server Usage Report, under the Web Activity by
> >> > Computer section, I see two computers that are no longer on the domain,
> >> > (they
> >> > don't even exist any more!), AND they seem to have 24hr/day web
> >> > activity.
> >> >
> >> > I checked with Manage Computers on the SBS machine (standard version,
> >> > 2003)
> >> > and confirmed that these two machines are not on the network. How then
> >> > does
> >> > the server usage report still show them, and show them as being active?
> >> >
> >> > Thanks,
> >> >
> >> > - Pasta
> >>
> >>
>
>
>

Larry
Mon May 05 18:32:25 PDT 2008

Well, you can force a new one:

In Server Management, monitoring and reporting, select "view usage report"
on the left and click "create a new report" on the right.

Or, you can force it to start over from scratch, but be aware that all the
accumulated data will be lost.

I hate to retype, so from my notes:

<snip>
NOTE: After doing the following steps, the original performance and usage
data will be removed. The server will start to collect new counter value
from the beginning.


1. Open Server Management console, navigate to 'Monitoring and Reporting'
snap-in. In the right panel, click 'Set Up Monitoring Reports and Alerts'.


2. In the wizard, click 'Next'->Select 'Reinstall monitoring
features'->Select the options if you want to receive the report e-mails.
Check 'View the usage report in Server Management' option. If you want to
receive the usage report e-mail, also check the option below->Add the users
which you allow them to view the usage report to the authorized
list->Select the option if you want to receive the performance
alerts->Click 'Finish' button to complete the configurations.


3. After doing the above steps, the performance and usage data will be
reset. Please wait for 24 hours and then you will see the reports through
the Monitoring and Reporting console.


Hope this helps.


Best Regards,


Chace Zhang (MSFT)
<end snip>


--
Larry

Please post the resolution to
your issue so that all can benefit.


"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:4E984DB1-7544-45AB-8DA6-FAE371D3F70C@microsoft.com...
> Hey Larry,
>
> That sbsbpa is cool! Thanks.
>
> I've followed all its advice, and yours too, but how do I know if its made
> a
> difference? I only get the Extended Server Usage Report every two weeks,
> so
> do I need to wait until then to see if the dead are still walking?
>
> - Pasta
>
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> www.sbsbpa.com
>>
>> do what ever it tells you.
>>
>> from the server try:
>>
>> start - run - cmd
>>
>> in the cmd (dos) box that opens type
>>
>> ipconfig /flushdns
>> then
>> ipconfig /registerdns
>>
>> then check again.
>>
>> --
>> Larry
>>
>> Please post the resolution to
>> your issue so that all can benefit.
>>
>>
>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> news:C4601FDC-2A17-4D9E-AA2B-BE73B5F8C038@microsoft.com...
>> > Hey Cliff, Larry and kj,
>> >
>> > Thanks for the replies! Let me reply to all three at once...
>> >
>> > Pinging the dead by name doesn't help: I just get told that the ping
>> > request
>> > could not find host xxxx.
>> >
>> > I removed the machine via the remove computers wizard, yep.
>> >
>> > How do I check reverse DNS, and what is the SBS BPA?
>> >
>> > Thanks again,
>> >
>> > - Pasta
>> >
>> > "Cliff Galiher" wrote:
>> >
>> >> If the computers weren't removed properly then it is possible that
>> >> your
>> >> DNS
>> >> is out of sync with the rest of the system. Check your reverse DNS
>> >> records
>> >> and see if there are ptr records for the old machines. It is possible
>> >> that
>> >> new machines now have those old IP addresses and thus causing
>> >> problems.
>> >>
>> >> Try out the SBS BPA, it tends to spot some problems like this.
>> >>
>> >> -Cliff
>> >>
>> >>
>> >> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> >> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> >> > Hi,
>> >> >
>> >> > In my recent Extended Server Usage Report, under the Web Activity by
>> >> > Computer section, I see two computers that are no longer on the
>> >> > domain,
>> >> > (they
>> >> > don't even exist any more!), AND they seem to have 24hr/day web
>> >> > activity.
>> >> >
>> >> > I checked with Manage Computers on the SBS machine (standard
>> >> > version,
>> >> > 2003)
>> >> > and confirmed that these two machines are not on the network. How
>> >> > then
>> >> > does
>> >> > the server usage report still show them, and show them as being
>> >> > active?
>> >> >
>> >> > Thanks,
>> >> >
>> >> > - Pasta
>> >>
>> >>
>>
>>
>>

Cliff
Tue May 06 00:08:26 PDT 2008

Well, it'd help if we knew what advice it gave you and what you did. :) We
could at least hazard a guess on whether it sounds related. But to answer
your other question, under server management in your DNS module, there is a
"reverse zone" that will have something that looks kinda like your IP subnet
and have records in there with machines associated with IPs. That is
probably the culprit.

But, now that I've told you where it is, I'm going to backtrack on my
previous advice...a little. Don't go playing in there alone. Get somebody
who knows Microsoft's DNS, preferably familiar with SBS, and work with them.
I say this because, unless you are familiar with DNS, you can really monkey
things up.

-Cliff


"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:4E984DB1-7544-45AB-8DA6-FAE371D3F70C@microsoft.com...
> Hey Larry,
>
> That sbsbpa is cool! Thanks.
>
> I've followed all its advice, and yours too, but how do I know if its made
> a
> difference? I only get the Extended Server Usage Report every two weeks,
> so
> do I need to wait until then to see if the dead are still walking?
>
> - Pasta
>
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> www.sbsbpa.com
>>
>> do what ever it tells you.
>>
>> from the server try:
>>
>> start - run - cmd
>>
>> in the cmd (dos) box that opens type
>>
>> ipconfig /flushdns
>> then
>> ipconfig /registerdns
>>
>> then check again.
>>
>> --
>> Larry
>>
>> Please post the resolution to
>> your issue so that all can benefit.
>>
>>
>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> news:C4601FDC-2A17-4D9E-AA2B-BE73B5F8C038@microsoft.com...
>> > Hey Cliff, Larry and kj,
>> >
>> > Thanks for the replies! Let me reply to all three at once...
>> >
>> > Pinging the dead by name doesn't help: I just get told that the ping
>> > request
>> > could not find host xxxx.
>> >
>> > I removed the machine via the remove computers wizard, yep.
>> >
>> > How do I check reverse DNS, and what is the SBS BPA?
>> >
>> > Thanks again,
>> >
>> > - Pasta
>> >
>> > "Cliff Galiher" wrote:
>> >
>> >> If the computers weren't removed properly then it is possible that
>> >> your
>> >> DNS
>> >> is out of sync with the rest of the system. Check your reverse DNS
>> >> records
>> >> and see if there are ptr records for the old machines. It is possible
>> >> that
>> >> new machines now have those old IP addresses and thus causing
>> >> problems.
>> >>
>> >> Try out the SBS BPA, it tends to spot some problems like this.
>> >>
>> >> -Cliff
>> >>
>> >>
>> >> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> >> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> >> > Hi,
>> >> >
>> >> > In my recent Extended Server Usage Report, under the Web Activity by
>> >> > Computer section, I see two computers that are no longer on the
>> >> > domain,
>> >> > (they
>> >> > don't even exist any more!), AND they seem to have 24hr/day web
>> >> > activity.
>> >> >
>> >> > I checked with Manage Computers on the SBS machine (standard
>> >> > version,
>> >> > 2003)
>> >> > and confirmed that these two machines are not on the network. How
>> >> > then
>> >> > does
>> >> > the server usage report still show them, and show them as being
>> >> > active?
>> >> >
>> >> > Thanks,
>> >> >
>> >> > - Pasta
>> >>
>> >>
>>
>>
>>

Cliff
Tue May 06 00:10:27 PDT 2008

I like where you are going Gumby, but removing the computers from the domain
should've blown away there credentials so they couldn't be checking in
remotely. Or did I miss something?

-Cliff


"SuperGumby [SBS MVP]" <not@your.nellie> wrote in message
news:OC2KBEwrIHA.484@TK2MSFTNGP04.phx.gbl...
> Though other chat is relevent I'm interested in the status of these 'dead'
> PC's. Have they been destroyed (wiped) or have they been given away and
> are possibly still running the original install?
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> Hi,
>>
>> In my recent Extended Server Usage Report, under the Web Activity by
>> Computer section, I see two computers that are no longer on the domain,
>> (they
>> don't even exist any more!), AND they seem to have 24hr/day web activity.
>>
>> I checked with Manage Computers on the SBS machine (standard version,
>> 2003)
>> and confirmed that these two machines are not on the network. How then
>> does
>> the server usage report still show them, and show them as being active?
>>
>> Thanks,
>>
>> - Pasta
>
>

Psychopasta
Tue May 06 08:16:01 PDT 2008

Thanks! I'll reset the reports and see what happens.

- P

"Larry Struckmeyer [SBS-MVP]" wrote:

> Well, you can force a new one:
>
> In Server Management, monitoring and reporting, select "view usage report"
> on the left and click "create a new report" on the right.
>
> Or, you can force it to start over from scratch, but be aware that all the
> accumulated data will be lost.
>
> I hate to retype, so from my notes:
>
> <snip>
> NOTE: After doing the following steps, the original performance and usage
> data will be removed. The server will start to collect new counter value
> from the beginning.
>
>
> 1. Open Server Management console, navigate to 'Monitoring and Reporting'
> snap-in. In the right panel, click 'Set Up Monitoring Reports and Alerts'.
>
>
> 2. In the wizard, click 'Next'->Select 'Reinstall monitoring
> features'->Select the options if you want to receive the report e-mails.
> Check 'View the usage report in Server Management' option. If you want to
> receive the usage report e-mail, also check the option below->Add the users
> which you allow them to view the usage report to the authorized
> list->Select the option if you want to receive the performance
> alerts->Click 'Finish' button to complete the configurations.
>
>
> 3. After doing the above steps, the performance and usage data will be
> reset. Please wait for 24 hours and then you will see the reports through
> the Monitoring and Reporting console.
>
>
> Hope this helps.
>
>
> Best Regards,
>
>
> Chace Zhang (MSFT)
> <end snip>
>
>
> --
> Larry
>
> Please post the resolution to
> your issue so that all can benefit.
>
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:4E984DB1-7544-45AB-8DA6-FAE371D3F70C@microsoft.com...
> > Hey Larry,
> >
> > That sbsbpa is cool! Thanks.
> >
> > I've followed all its advice, and yours too, but how do I know if its made
> > a
> > difference? I only get the Extended Server Usage Report every two weeks,
> > so
> > do I need to wait until then to see if the dead are still walking?
> >
> > - Pasta
> >
> >
> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >
> >> www.sbsbpa.com
> >>
> >> do what ever it tells you.
> >>
> >> from the server try:
> >>
> >> start - run - cmd
> >>
> >> in the cmd (dos) box that opens type
> >>
> >> ipconfig /flushdns
> >> then
> >> ipconfig /registerdns
> >>
> >> then check again.
> >>
> >> --
> >> Larry
> >>
> >> Please post the resolution to
> >> your issue so that all can benefit.
> >>
> >>
> >> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> >> news:C4601FDC-2A17-4D9E-AA2B-BE73B5F8C038@microsoft.com...
> >> > Hey Cliff, Larry and kj,
> >> >
> >> > Thanks for the replies! Let me reply to all three at once...
> >> >
> >> > Pinging the dead by name doesn't help: I just get told that the ping
> >> > request
> >> > could not find host xxxx.
> >> >
> >> > I removed the machine via the remove computers wizard, yep.
> >> >
> >> > How do I check reverse DNS, and what is the SBS BPA?
> >> >
> >> > Thanks again,
> >> >
> >> > - Pasta
> >> >
> >> > "Cliff Galiher" wrote:
> >> >
> >> >> If the computers weren't removed properly then it is possible that
> >> >> your
> >> >> DNS
> >> >> is out of sync with the rest of the system. Check your reverse DNS
> >> >> records
> >> >> and see if there are ptr records for the old machines. It is possible
> >> >> that
> >> >> new machines now have those old IP addresses and thus causing
> >> >> problems.
> >> >>
> >> >> Try out the SBS BPA, it tends to spot some problems like this.
> >> >>
> >> >> -Cliff
> >> >>
> >> >>
> >> >> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> >> >> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> >> >> > Hi,
> >> >> >
> >> >> > In my recent Extended Server Usage Report, under the Web Activity by
> >> >> > Computer section, I see two computers that are no longer on the
> >> >> > domain,
> >> >> > (they
> >> >> > don't even exist any more!), AND they seem to have 24hr/day web
> >> >> > activity.
> >> >> >
> >> >> > I checked with Manage Computers on the SBS machine (standard
> >> >> > version,
> >> >> > 2003)
> >> >> > and confirmed that these two machines are not on the network. How
> >> >> > then
> >> >> > does
> >> >> > the server usage report still show them, and show them as being
> >> >> > active?
> >> >> >
> >> >> > Thanks,
> >> >> >
> >> >> > - Pasta
> >> >>
> >> >>
> >>
> >>
> >>
>
>
>

Psychopasta
Tue May 06 08:16:01 PDT 2008

The computers no longer exist. One was smashed to pieces by small children
(honest) the other is in my office turned off, not plugged into anything.

Spooky!

- pasta

"SuperGumby [SBS MVP]" wrote:

> Though other chat is relevent I'm interested in the status of these 'dead'
> PC's. Have they been destroyed (wiped) or have they been given away and are
> possibly still running the original install?
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> > Hi,
> >
> > In my recent Extended Server Usage Report, under the Web Activity by
> > Computer section, I see two computers that are no longer on the domain,
> > (they
> > don't even exist any more!), AND they seem to have 24hr/day web activity.
> >
> > I checked with Manage Computers on the SBS machine (standard version,
> > 2003)
> > and confirmed that these two machines are not on the network. How then
> > does
> > the server usage report still show them, and show them as being active?
> >
> > Thanks,
> >
> > - Pasta
>
>
>

SuperGumby
Tue May 06 08:58:39 PDT 2008

so much for that idea then.

I'd have to stick with others then that it is most likely some DNS issue,
the name is being linked to another PC. May have been interesting to compare
traffic values for other PC's but I fear it may be too late (if you've reset
the data).

"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
> The computers no longer exist. One was smashed to pieces by small children
> (honest) the other is in my office turned off, not plugged into anything.
>
> Spooky!
>
> - pasta
>
> "SuperGumby [SBS MVP]" wrote:
>
>> Though other chat is relevent I'm interested in the status of these
>> 'dead'
>> PC's. Have they been destroyed (wiped) or have they been given away and
>> are
>> possibly still running the original install?
>>
>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> > Hi,
>> >
>> > In my recent Extended Server Usage Report, under the Web Activity by
>> > Computer section, I see two computers that are no longer on the domain,
>> > (they
>> > don't even exist any more!), AND they seem to have 24hr/day web
>> > activity.
>> >
>> > I checked with Manage Computers on the SBS machine (standard version,
>> > 2003)
>> > and confirmed that these two machines are not on the network. How then
>> > does
>> > the server usage report still show them, and show them as being active?
>> >
>> > Thanks,
>> >
>> > - Pasta
>>
>>
>>

kj
Tue May 06 09:32:48 PDT 2008

SuperGumby [SBS MVP] wrote:
> so much for that idea then.
>
> I'd have to stick with others then that it is most likely some DNS
> issue, the name is being linked to another PC. May have been
> interesting to compare traffic values for other PC's but I fear it
> may be too late (if you've reset the data).

Safe (read only) way to check DNS forward resolution is;

nslookup
>"hostname"

For reservse lookup

nslookup
>set type=ptr
>192.168.x.x (use whatever the forward lookup gave you)

>

> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
>> The computers no longer exist. One was smashed to pieces by small
>> children (honest) the other is in my office turned off, not plugged
>> into anything. Spooky!
>>
>> - pasta
>>
>> "SuperGumby [SBS MVP]" wrote:
>>
>>> Though other chat is relevent I'm interested in the status of these
>>> 'dead'
>>> PC's. Have they been destroyed (wiped) or have they been given away
>>> and are
>>> possibly still running the original install?
>>>
>>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in
>>> message news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>>>> Hi,
>>>>
>>>> In my recent Extended Server Usage Report, under the Web Activity
>>>> by Computer section, I see two computers that are no longer on the
>>>> domain, (they
>>>> don't even exist any more!), AND they seem to have 24hr/day web
>>>> activity.
>>>>
>>>> I checked with Manage Computers on the SBS machine (standard
>>>> version, 2003)
>>>> and confirmed that these two machines are not on the network. How
>>>> then does
>>>> the server usage report still show them, and show them as being
>>>> active? Thanks,
>>>>
>>>> - Pasta

--
/kj

Psychopasta
Tue May 06 10:28:04 PDT 2008

Thanks again to everyone who has responded.

I tried nslookup on the dead and they weren't found. Just to be sure, I
tried it on the living and they were OK ;-)

I have reinstalled the monitoring service as Larry (Grace?) suggested, and
I'll let you all know what it says tomorrow!

- Pasta

"kj [SBS MVP]" wrote:

> SuperGumby [SBS MVP] wrote:
> > so much for that idea then.
> >
> > I'd have to stick with others then that it is most likely some DNS
> > issue, the name is being linked to another PC. May have been
> > interesting to compare traffic values for other PC's but I fear it
> > may be too late (if you've reset the data).
>
> Safe (read only) way to check DNS forward resolution is;
>
> nslookup
> >"hostname"
>
> For reservse lookup
>
> nslookup
> >set type=ptr
> >192.168.x.x (use whatever the forward lookup gave you)
>
> >
>
> > "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> > news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
> >> The computers no longer exist. One was smashed to pieces by small
> >> children (honest) the other is in my office turned off, not plugged
> >> into anything. Spooky!
> >>
> >> - pasta
> >>
> >> "SuperGumby [SBS MVP]" wrote:
> >>
> >>> Though other chat is relevent I'm interested in the status of these
> >>> 'dead'
> >>> PC's. Have they been destroyed (wiped) or have they been given away
> >>> and are
> >>> possibly still running the original install?
> >>>
> >>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in
> >>> message news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> >>>> Hi,
> >>>>
> >>>> In my recent Extended Server Usage Report, under the Web Activity
> >>>> by Computer section, I see two computers that are no longer on the
> >>>> domain, (they
> >>>> don't even exist any more!), AND they seem to have 24hr/day web
> >>>> activity.
> >>>>
> >>>> I checked with Manage Computers on the SBS machine (standard
> >>>> version, 2003)
> >>>> and confirmed that these two machines are not on the network. How
> >>>> then does
> >>>> the server usage report still show them, and show them as being
> >>>> active? Thanks,
> >>>>
> >>>> - Pasta
>
> --
> /kj
>
>
>

Cliff
Wed May 07 18:23:16 PDT 2008

Not surprised that the dead didn't show up on forward lookup. As I posted
earlier, I suspect this is a reverse lookup *only.* Which is a catch-22.
The report gives a name that you can't get an IP for because forward works.
And you can't use nslookup to check for reverse-lookup problems because you
don't have that IP.

The easiest way to verify this is to use the DNS MMC and look at the reverse
zone...

-Cliff

"Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
news:F7216DA8-D77F-48F2-B577-38A44F0BFA2E@microsoft.com...
> Thanks again to everyone who has responded.
>
> I tried nslookup on the dead and they weren't found. Just to be sure, I
> tried it on the living and they were OK ;-)
>
> I have reinstalled the monitoring service as Larry (Grace?) suggested, and
> I'll let you all know what it says tomorrow!
>
> - Pasta
>
> "kj [SBS MVP]" wrote:
>
>> SuperGumby [SBS MVP] wrote:
>> > so much for that idea then.
>> >
>> > I'd have to stick with others then that it is most likely some DNS
>> > issue, the name is being linked to another PC. May have been
>> > interesting to compare traffic values for other PC's but I fear it
>> > may be too late (if you've reset the data).
>>
>> Safe (read only) way to check DNS forward resolution is;
>>
>> nslookup
>> >"hostname"
>>
>> For reservse lookup
>>
>> nslookup
>> >set type=ptr
>> >192.168.x.x (use whatever the forward lookup gave you)
>>
>> >
>>
>> > "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
>> > news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
>> >> The computers no longer exist. One was smashed to pieces by small
>> >> children (honest) the other is in my office turned off, not plugged
>> >> into anything. Spooky!
>> >>
>> >> - pasta
>> >>
>> >> "SuperGumby [SBS MVP]" wrote:
>> >>
>> >>> Though other chat is relevent I'm interested in the status of these
>> >>> 'dead'
>> >>> PC's. Have they been destroyed (wiped) or have they been given away
>> >>> and are
>> >>> possibly still running the original install?
>> >>>
>> >>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in
>> >>> message news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
>> >>>> Hi,
>> >>>>
>> >>>> In my recent Extended Server Usage Report, under the Web Activity
>> >>>> by Computer section, I see two computers that are no longer on the
>> >>>> domain, (they
>> >>>> don't even exist any more!), AND they seem to have 24hr/day web
>> >>>> activity.
>> >>>>
>> >>>> I checked with Manage Computers on the SBS machine (standard
>> >>>> version, 2003)
>> >>>> and confirmed that these two machines are not on the network. How
>> >>>> then does
>> >>>> the server usage report still show them, and show them as being
>> >>>> active? Thanks,
>> >>>>
>> >>>> - Pasta
>>
>> --
>> /kj
>>
>>
>>

Psychopasta
Thu May 08 08:44:00 PDT 2008

Hi Cliff,

That was it. I looked in the reverse zone, and there were the dead. Two
silver bullets (well, right-mouse-clicking and selecting delete) later and
they were consigned to the hell-hole they belong.

I restarted the Reports service again, so I'll see if they stay dead this
time. I'll let you kow what happens.

- Pasta

"Cliff Galiher" wrote:

> Not surprised that the dead didn't show up on forward lookup. As I posted
> earlier, I suspect this is a reverse lookup *only.* Which is a catch-22.
> The report gives a name that you can't get an IP for because forward works.
> And you can't use nslookup to check for reverse-lookup problems because you
> don't have that IP.
>
> The easiest way to verify this is to use the DNS MMC and look at the reverse
> zone...
>
> -Cliff
>
> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> news:F7216DA8-D77F-48F2-B577-38A44F0BFA2E@microsoft.com...
> > Thanks again to everyone who has responded.
> >
> > I tried nslookup on the dead and they weren't found. Just to be sure, I
> > tried it on the living and they were OK ;-)
> >
> > I have reinstalled the monitoring service as Larry (Grace?) suggested, and
> > I'll let you all know what it says tomorrow!
> >
> > - Pasta
> >
> > "kj [SBS MVP]" wrote:
> >
> >> SuperGumby [SBS MVP] wrote:
> >> > so much for that idea then.
> >> >
> >> > I'd have to stick with others then that it is most likely some DNS
> >> > issue, the name is being linked to another PC. May have been
> >> > interesting to compare traffic values for other PC's but I fear it
> >> > may be too late (if you've reset the data).
> >>
> >> Safe (read only) way to check DNS forward resolution is;
> >>
> >> nslookup
> >> >"hostname"
> >>
> >> For reservse lookup
> >>
> >> nslookup
> >> >set type=ptr
> >> >192.168.x.x (use whatever the forward lookup gave you)
> >>
> >> >
> >>
> >> > "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> >> > news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
> >> >> The computers no longer exist. One was smashed to pieces by small
> >> >> children (honest) the other is in my office turned off, not plugged
> >> >> into anything. Spooky!
> >> >>
> >> >> - pasta
> >> >>
> >> >> "SuperGumby [SBS MVP]" wrote:
> >> >>
> >> >>> Though other chat is relevent I'm interested in the status of these
> >> >>> 'dead'
> >> >>> PC's. Have they been destroyed (wiped) or have they been given away
> >> >>> and are
> >> >>> possibly still running the original install?
> >> >>>
> >> >>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in
> >> >>> message news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> >> >>>> Hi,
> >> >>>>
> >> >>>> In my recent Extended Server Usage Report, under the Web Activity
> >> >>>> by Computer section, I see two computers that are no longer on the
> >> >>>> domain, (they
> >> >>>> don't even exist any more!), AND they seem to have 24hr/day web
> >> >>>> activity.
> >> >>>>
> >> >>>> I checked with Manage Computers on the SBS machine (standard
> >> >>>> version, 2003)
> >> >>>> and confirmed that these two machines are not on the network. How
> >> >>>> then does
> >> >>>> the server usage report still show them, and show them as being
> >> >>>> active? Thanks,
> >> >>>>
> >> >>>> - Pasta
> >>
> >> --
> >> /kj
> >>
> >>
> >>
>

Psychopasta
Mon May 12 12:29:15 PDT 2008

Hi Cliff, and everyone else who replied,

OK, that did it. They're dead and they're staying dead.

Thanks again,

Pasta Van Helsing

"Psychopasta" wrote:

> Hi Cliff,
>
> That was it. I looked in the reverse zone, and there were the dead. Two
> silver bullets (well, right-mouse-clicking and selecting delete) later and
> they were consigned to the hell-hole they belong.
>
> I restarted the Reports service again, so I'll see if they stay dead this
> time. I'll let you kow what happens.
>
> - Pasta
>
> "Cliff Galiher" wrote:
>
> > Not surprised that the dead didn't show up on forward lookup. As I posted
> > earlier, I suspect this is a reverse lookup *only.* Which is a catch-22.
> > The report gives a name that you can't get an IP for because forward works.
> > And you can't use nslookup to check for reverse-lookup problems because you
> > don't have that IP.
> >
> > The easiest way to verify this is to use the DNS MMC and look at the reverse
> > zone...
> >
> > -Cliff
> >
> > "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> > news:F7216DA8-D77F-48F2-B577-38A44F0BFA2E@microsoft.com...
> > > Thanks again to everyone who has responded.
> > >
> > > I tried nslookup on the dead and they weren't found. Just to be sure, I
> > > tried it on the living and they were OK ;-)
> > >
> > > I have reinstalled the monitoring service as Larry (Grace?) suggested, and
> > > I'll let you all know what it says tomorrow!
> > >
> > > - Pasta
> > >
> > > "kj [SBS MVP]" wrote:
> > >
> > >> SuperGumby [SBS MVP] wrote:
> > >> > so much for that idea then.
> > >> >
> > >> > I'd have to stick with others then that it is most likely some DNS
> > >> > issue, the name is being linked to another PC. May have been
> > >> > interesting to compare traffic values for other PC's but I fear it
> > >> > may be too late (if you've reset the data).
> > >>
> > >> Safe (read only) way to check DNS forward resolution is;
> > >>
> > >> nslookup
> > >> >"hostname"
> > >>
> > >> For reservse lookup
> > >>
> > >> nslookup
> > >> >set type=ptr
> > >> >192.168.x.x (use whatever the forward lookup gave you)
> > >>
> > >> >
> > >>
> > >> > "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in message
> > >> > news:A78C70AD-609B-452D-B087-98992F507A0E@microsoft.com...
> > >> >> The computers no longer exist. One was smashed to pieces by small
> > >> >> children (honest) the other is in my office turned off, not plugged
> > >> >> into anything. Spooky!
> > >> >>
> > >> >> - pasta
> > >> >>
> > >> >> "SuperGumby [SBS MVP]" wrote:
> > >> >>
> > >> >>> Though other chat is relevent I'm interested in the status of these
> > >> >>> 'dead'
> > >> >>> PC's. Have they been destroyed (wiped) or have they been given away
> > >> >>> and are
> > >> >>> possibly still running the original install?
> > >> >>>
> > >> >>> "Psychopasta" <Psychopasta@discussions.microsoft.com> wrote in
> > >> >>> message news:CBAFD053-1FC9-4996-9E03-32C05C8CF5EE@microsoft.com...
> > >> >>>> Hi,
> > >> >>>>
> > >> >>>> In my recent Extended Server Usage Report, under the Web Activity
> > >> >>>> by Computer section, I see two computers that are no longer on the
> > >> >>>> domain, (they
> > >> >>>> don't even exist any more!), AND they seem to have 24hr/day web
> > >> >>>> activity.
> > >> >>>>
> > >> >>>> I checked with Manage Computers on the SBS machine (standard
> > >> >>>> version, 2003)
> > >> >>>> and confirmed that these two machines are not on the network. How
> > >> >>>> then does
> > >> >>>> the server usage report still show them, and show them as being
> > >> >>>> active? Thanks,
> > >> >>>>
> > >> >>>> - Pasta
> > >>
> > >> --
> > >> /kj
> > >>
> > >>
> > >>
> >