Unused Server Network Interfaces are Dangerous

I am very careful on servers to disable ALL unused network interfaces, lest they corrupt the domain. Here is why:

I once got called out on a job to give MS PSS support a hand onsite. Unusual I thought at the time, normally I ring PSS, not they ring me. Anyway, they had a rough time getting a client up and running and needed someone on the ground that could help sort through it.

When I got there the Windows 2000 Domain Controller and Exchange 2000 Server  were both very unhappy. The Exchange database was offline, corrupted, and the Domain had more errors in the event log than I had seen before.

After a bit of digging I found the problem. The Domain Controller had two network interfaces, a fairly common thing with server hardware. One of these interfaces had given itself a Private IP address, despite not being plugged in. Most of the Domain SRV records had been redirected to this private (and unusable) IP, making the Domain controller intermittently un-contactable. This had gone on for a significant period of time, before the other Domain Controller had lost sync and gone offline corrupted. The Exchange server hadn’t taken long after that to do similar.

Disabling the unused interface resulted in just one DNS registration, and presto, a happy AD DC again.

Recovering the Exchange Server was not so much fun. It turned out the “backups” were file level, not Information Store backups, so useless. The Information Store failed recovery with ESEUtil and ISInteg. I left PSS to sort that mess out.

I had seen similar behavior before with ISA boxes registering the incorrect interface. Now I am very careful to disable any unused interfaces, thus solving much DNS weirdness.

In theory the interface detection solves this, and I haven’t seen the problem in Server 2003, so maybe it was solved. I’ll keep being cautious.

Leave a Reply