Windows update DNS issue..

a few wees ago i noticed that Windows update stopped working on our coprate
LAN. It would error out with the 0x8072EE7 Error code. with a little
research i found this to be a problem with Name resolution.. We run non
athoratative internal DNS hosted on Server 2003 to resolve local Machine
names, and the rest of DNS requests are forwareded to our ISPs DNS boxes. I
tried all the fixes i dug up in this news group, to no avail.. Next I
staticly assigned Primary and secondary IPs for public DNS servers ..
windows update worked flawlessly.. so the issue has to be with our internal
DNS servers.. I looked at the DNS logs on them.. the folowing event is
generated anytime you try to hit Windows update.

Event ID: 5504
The DNS server encountered an invalid domain name in a packet from
69.63.218.208. the packet will be rejected.

Anyone have any thoughts on this??

"DanP" <> wrote in message
news2D2B1F0-7851-4042-9D89-...
>a few wees ago i noticed that Windows update stopped working on our coprate
> LAN. It would error out with the 0x8072EE7 Error code. with a little
> research i found this to be a problem with Name resolution.. We run non
> athoratative internal DNS hosted on Server 2003 to resolve local Machine
> names, and the rest of DNS requests are forwareded to our ISPs DNS boxes. I
> tried all the fixes i dug up in this news group, to no avail.. Next I
> staticly assigned Primary and secondary IPs for public DNS servers ..
> windows update worked flawlessly.. so the issue has to be with our internal
> DNS servers.. I looked at the DNS logs on them.. the folowing event is
> generated anytime you try to hit Windows update.
>
> Event ID: 5504
> The DNS server encountered an invalid domain name in a packet from
> 69.63.218.208. the packet will be rejected.
>
> Anyone have any thoughts on this??


Does your nslookup know about redwire.net?

Name: c-69-63-218-208.sd2.redwire.net
Address: 69.63.218.208


Non-authoritative answer:
Name: redwire.net
Address: 64.186.240.53


What port is being used? I would wonder if you have a Trojan.

Does netstat -ao yield any clues?
Tip: use tasklist /fi "PID eq ..." to help identify the exposed tasks.


HTH

Robert Aldwinckle
---