ERRORS WITH DNS????

I believe this issue I am having is a DNS or exchange issue im not sure but

1) Does anyone know what would constantly cause a server to get Master Browser errors event id 8003? The error goes something like::::

The master browser has received a server announcement from the computer CATXX that believes that it is the master browser for the domain on transport.......

Seems most of these errors have been happening constantly lately almost every hour
This is primary DNS Server & Exchange 2003 enviroment.
There is also another secondary DNS server.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

iowatech

Have you put any new machines on the network recently? They could be attempting Master Browser status and failing do to obvious rights issues.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList

Switch that value in there to "False" if so.

j938

I havent put any new machines on the network at all. I am curious to know why another machine would think it is the master browser for the domain though.

iowatech

Could you post the "exact" body text of the event?

j938

iowatech wrote:

Could you post the "exact" body text of the event?

The master browser has received a server announcement from the computer <computer name> that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B7545DFC-BA6C-4712-81. The master browser is stopping or an election is being forced.

I get this hour after hour

dtlokee

j938 wrote:

I havent put any new machines on the network at all. I am curious to know why another machine would think it is the master browser for the domain though.

You can edit the registry to force a computer to become the master browser of the network or I think the PDC of domain always wanted to be the master browser, possibly this behavior is still emulated by the PCD emulator role or a DC that was the PDC emulator. Maybe it was a device that was not connected to the netwrok and determined it should be the master browser and once other devices are seen it still wants to be the master browser. More info would help.

dynamik

This might help: http://weblog.techdad.net/2007/05/09/how-to-fix-master-browser-mrxsmb-event-id-8003-errors/

I believe that is the reg edit DT was referring to.

Ahriakin

It's WINS/NetBIOS not DNS btw. Have you WINS running on your network? If so make sure the offending machine has your WINS server configured as it's own in the IP properties, in fact if you are supporting network browsing then make sure ALL systems point to your WINS server. It's a lot more reliable than leaving it to browse-master elections.

j938

dtlokee wrote:

j938 wrote:

I havent put any new machines on the network at all. I am curious to know why another machine would think it is the master browser for the domain though.

You can edit the registry to force a computer to become the master browser of the network or I think the PDC of domain always wanted to be the master browser, possibly this behavior is still emulated by the PCD emulator role or a DC that was the PDC emulator. Maybe it was a device that was not connected to the netwrok and determined it should be the master browser and once other devices are seen it still wants to be the master browser. More info would help.

After each hour another computer sees itself as the master browser for the domain
there hasnt been any new computers added on all computer stay connected via ethernet.

j938

Ahriakin wrote:

It's WINS/NetBIOS not DNS btw. Have you WINS running on your network? If so make sure the offending machine has your WINS server configured as it's own in the IP properties, in fact if you are supporting network browsing then make sure ALL systems point to your WINS server. It's a lot more reliable than leaving it to browse-master elections.

We have a wins server.

and what causes it not to not be the master nomore?
or hows does the each computer take over to be the master browser.

==im also trying to google to find out but all info is greatly appreciated thanks.

Netstudent

I have a question as well if you don't mind.

I have the same issue but we have 2 WINS servers on 2 different DC's that are on 2 different subnets. BUt they are in the same domain. My messages are the same only the computer that thinks it is the master browser is the other WINS server. As if they are both contending to be the master browser.

It would not be a good thing if killed the service on the NON-PDC which is also a WINS server right? Woulnd;t it completely negate the WINS service on the non PDC if I were to stop the computer browser or edit the registry?

dtlokee

Netstudent wrote:

I have a question as well if you don't mind.

I have the same issue but we have 2 WINS servers on 2 different DC's that are on 2 different subnets. BUt they are in the same domain. My messages are the same only the computer that thinks it is the master browser is the other WINS server. As if they are both contending to be the master browser.

It would not be a good thing if killed the service on the NON-PDC which is also a WINS server right? Woulnd;t it completely negate the WINS service on the non PDC if I were to stop the computer browser or edit the registry?

First, the master browser is elected on a subnet by subnet basis (each one should have one). It would make sense that the WINS server always become the master browser (it has a database of all netbios/name information for all registered clients not just the local subent) so I wouldn't change it. I am not shure how they are receiving each other's master browser announcements because they are not supposed to be routable, if you have fallback bridging or somthing similar that may be causing the issues.

OP: Another random thought about this, if the computers are running a personal firewall (like Windows Firewall) they may not hear the unslicited announcement by the existing master browser of it's presence and therefore assume there is none and assum the role of master browser.

dynamik

If you google "8003 master browser" (without the quotes), you will get a good number of results related to subnet issues. The most common problem seems to stem from having your network device setup to forward those type of communications between subnets.

Netstudent

ya thats strange.....These 2 DC's are on opposite sides of a MPLS WAN link.

But these two WINS servers are setup to replicate to each other. They both have push/pull settings that point to the other. That may be how they are communicating on that level.

I'll have to chekc it out...I have been to busy to hunt down quirky little eventvwr events.

Upon further review, I found that multiple client machines from all subnets are getting through to the PDC.

EDIT
The knowledge base article says that this occurs when the subnet mask is incorrect on the client from that of the DC. I also noticed in my eventvwr that this event occurs simulataneously with a DHCP event stating that 90% of our subnet is used. It's one for one each time. In my case it seems to be a DHCP related issue. I have random machines all over the place announcing master borwser status.

I also found this which could be a likely culprit since our DHCP is consolidated and our hosts pass a cisco MPLS core to get to the dhcp.
http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_tech_note09186a00802373f3.shtml

But would the

no ip forward-protocol {udp [port] | nd | sdns}

kill my WINS replication if I denied netbios 137 or 138?

I mean like you said DTlokee, netbios shouldn't be routable anyways.