Cannot see computers on domain.

[Averum]

I'm trying to determine why no computers on the domain are visible to me from the Malwarebytes Enterprise console. 

 

 

As you can see I can ping the target computer. This computer is a fresh image with only the Windows XP SP3 loaded onto it. Windows Firewall is deactivated (AD policy) and File and Printer Sharing is checked under exceptions. Network Access Sharing and Security is set to "Classic". 

 

What else do I need to be looking at?

[AdvancedSetup]

What do you get if you do an NSLOOKUP on that IP?

[Averum]

What do you get if you do an NSLOOKUP on that IP?

 

 

 

Server Name/Address

Host Name/IP

[AdvancedSetup]

Well if those are coming back blank then it would seem you don't have your DNS setup correctly on the network and you should check into that and get it corrected as that can and will affect all kinds of things on the network.

This is above and beyond the scope of MEE though as that is a normal Windows Networking issue.

You might see if this article is helpful for you in tracking down your issue.

Diagnosing Name Resolution Problems

[Averum]

No they come back with all the correct information.

[AdvancedSetup]

What if you expand the scope to an actual range and not a single target ?

[Averum]

We scanned a range that includes around 200 workstations. It picked up two devices which are not computers I am trying to manage. Both of them being devices that provide network connectivity for medical equipment. 

[AdvancedSetup]

Probably best to open a ticket on the Help Desk and have one of the Corporate MEE support technicians help you out with this.

[Averum]

Support had me enable "Enable Serial Client IP Detection" now I am getting lots of hits on the workstations.

 

I do have another question though. Under Admin > Client Push Install, there is an option to scan an IP range from a file. What should the formatting look like in the text file to utilize this. 

[Call_me_Metal]

For this file you can use either computer names or IP address.

The format should look something like this

 

10.0.0.1

10.0.0.2

10.0.0.3

10.0.0.4

 

One IP or computer name per line.

Do not include any unnecessary spaces or characters.

 

I hope that answers your question.

Please let us know if you require further assistance. 

[Averum]

For this file you can use either computer names or IP address.

The format should look something like this

 

10.0.0.1

10.0.0.2

10.0.0.3

10.0.0.4

 

One IP or computer name per line.

Do not include any unnecessary spaces or characters.

 

I hope that answers your question.

Please let us know if you require further assistance. 

 

Perfect, thank you. 

[Call_me_Metal]

You're very welcome.

 

Did you have any other questions we could assist you with?

[NickMurarik]

What exactly is "Enable Serial Client IP Detection" ?

[Call_me_Metal]

The normal way that the scan command works is to send out a blanket statement to any machine within the IP range.

Any devices that responds shows up in the detection list.

 

If you use the Serial Client IP Detection the scan waits at each IP for communication.

So it takes longer to complete but often returns better results.

 

I hope that answers your question.
Please let me know if you would like further details.