Okay guys, so my boss is away and unreachable, and our intranet isn't accessible. He changed the address for it on Friday because there was a conflict with another device. How do I track down the new address for the intranet? He only changed the last two digits eg http://xxx.xx.xx.yy/intranet/ and the new value of yy is what I need. I've tried typing manually from 1-100 without success.

It is ominous that you can even have such this problem, it implies there will be more to come.

First work out your subnet mask, if it is 255.255.255.0 then that runs from x.x.x.1 to x.x.x.254.
download netscan.exe and run a port scan of the subnet.
Your server might show up with its name next to its IP, if not, at least you have a shorter list of IP addresses to try.


If your netmask is 255.0.0.0 (as I recently saw on a network I had the joy of fixing) then that netscan would have to run from x.0.0.1 to x.255.255.254 and could take a fair while to complete.


Are your computers part of an Active Directory domain? Right click computer and look at properties to find out. If your are a member of WORKGROUP or MSHOME then you may wish to plan for changing that. If you are a member of xxxxx.adr or something similar, your domain is a mess.

Ipconfig tells me subnet mask is 255.255.255.192

Computer is part of xxx.local where xxx is a server (I think!).


The whole thing feels like a mess. I'm trying to work out who is to blame. I suspect the Primary Care Trust installed the equipment and my boss has learnt from scratch how to run it all. Then again, he's had seven years of experience. I have until 1st August - that's when I officially take over!

My brain's still not fully engaged today so may be wrong, but if that subnet's correct, and the intranet server is on the same subnet, then it should be in the range x.x.x.1 to x.x.x.63

What if the intranet's on a different subnet?

The reason I ask is the addresses are completely different in format. The intranet is xxx.xx.xx.xx/intranet/ and the addresses for the computers from netscan are xx.xxx.xxx.xx

Yes. Except now we need to know what the last number is in Wolf's IP address. The possible ranges are x.x.x.1-63; x.x.x.65-127, 129-191, 193-254.
So if your IP is 172.16.33.188 then the range to scan is 172.16.33.129 to 172.16.33.191

If the computer is part of a .local domain then there should be a DNS server to issue this intranet box with a friendly name. So we should add to the shopping list of questions... who has domain admin privileges? Probably some third party who will charge an arm and a leg for a minor change like updating a DNS record.
As to how IP addresses are managed on this network - I dread to think.

Okay so I had no luck finding the intranet through that method. What I did was enter the range that the intranet was in. The intranet should have been xxx.xx.xx.10/intranet. Scanned from .0-.100 and what I got was the server was on .4 so typing in xxx.xx.xx4/intranet worked!

Confusing. Can anyone explain to me what happened?

There is either no method for properly managing mappings for resources on parts of your network, or they are easily ignored by amateurs.

I would guess somebody added a device to your network which stole the intranet server's IP (probably indicating that whoever added the server in the first place did nothing to notify other users), so your intranet box would have popped up a little message about a duplicate IP being found on the network. So your guy picked a spare IP and moved to that, and probably wrote the new address on a post-it note somewhere.

I guess in future, I could just use netscan again and try to find it but is there an easier/better way.

I have also just obtained the username/password to the servers but not all the software that runs on it, it seems

So what objectives should I create for myself this week? Boss reckons he has a network map in a drawer somewhere but I'll draw one out any way.

Well you have a small-ish subnet for your LAN, and that server exists in a DMZ of some sort. So your IP network is administered by somebody - probably the same people who are responsible for that Cisco router that sits under the SMC switch. Finding out if that is some remote and possibly incompetent part of the NHS, or an outsourced and uninterested collection of thieves like me is going to be essential info, possibly not knowable until the boss returns though.

The same applies to working out what is happening with your domain and DNS. Fire up a cmd and run "echo %logonserver%" that will tell you where you authenticate to. If the reply says srv-1 then try "ping srv-1". If that comes back as 10.10.10.1 then do "ipconfig/all" and see how many times 10.10.10.1 appears in the result. I would expect it to be your DNS and DCHP server. If not, you can try "ping -a <ip address>" to get names for whatever runs those services.

You're unlikely to have an administrator login to that server, but try to work out who does. They should be able to create a record in the DNS for you that links xxx.xx.xx.4 to intranet.yoursite.local and then at least you won't have too much trouble next time there is any issue (and it's easy to remember), you can just get that record changed if the IP moves around and everything is kind of fixed.

Also check out your printers, are they all connected via USB or do they have network connections? Are they shared out by a server, or do you have them set up with "local" IP ports?

logonserver tells me the name of the server, which isn't srv-1.
I pinged the server and it gave me an IP address it was pinging.

None of the info it gives me is related to the intranet address. The intranet starts off 172.xx.xx.x and the IP address is 10.xxx.xxx.xx - the gateway and DNS are in the same IP range as my IP address.

Will chat to boss about all this (hopefully today!).

Your gateway has to be inside the same range as your computer, and your domain controller usually would be too. The 172 range is a DMZ zone for putting servers that represent some kind of security risk into.

Does the one server cover logon, DNS and DHCP?
Try to work out if it is also the print server (network printers are usually "printer1 on svr-1" or similar)
And if you poke around in your Outlook (tools > accounts > "change" button) see what your Exchange server is (probably something completely different)
That lot will give you a starting point to troubleshoot a lot of the more common issues you can expect to face.

If I go into the Network stuff in control panel, I can see the server. If I go on that, I can see the other computers. Opening any one of them allows me to see the printers attached. Unfortunately, some of the computers I know are connected to printers but I can't seem to see them on the network, which makes me wonder how many are actually networked.

I take it from that that most of your printers are USB connected to PCs, and where shared it's probably from the PC not the server. If there's a high ratio of printers to desktops, that is probably an ok way to do stuff. You might not want to share printers for instance that are used to print out confidential health records.

Try going start > run > \\servername\ (enter) to see what is actually shared from the server. If you do the same with one of the computer names that you are seeing you should see where the relevant printer spool lives.

Also from command prompt type "net view" to see if there are more servers. Hopefully the names should make it obvious.

Tried \\servername\ but it didn't work. Net view did and it listed all the computers that I could see by going through Network Connections-> My Network Places -> Entire Network -> ServerName