Good day.
I faced the problem of the appearance of _VLMSC._tcp.domain.com record.
This record is responsible for the local KMS, but i don't have this service in my infrastructure.
Several interesting observations:
- record points to specific host, which has an open 1688 port and sppsvc.exe (Microsoft Software Protection Platform Service) listens to it;
- "slmgr.vbs -dlv" indicates running KMS with DNS publishing, but "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SL" is missing, no other suspicious activity (clean startup records; clean running process, verified by processexlorer; no records from antivirus... everything looks good).
- if i delete DNS record and restart sppsvc.exe service, it appears again (according to processexp, slmgr.vbs create this record, but this is not normally) ;
This problem occurs only for some win7 workstations and two clean 2012 servers.
If anyone has any idea on finding the cause of this problem, it will be wonderful.
I faced the problem of the appearance of _VLMSC._tcp.domain.com record.
This record is responsible for the local KMS, but i don't have this service in my infrastructure.
Several interesting observations:
- record points to specific host, which has an open 1688 port and sppsvc.exe (Microsoft Software Protection Platform Service) listens to it;
- "slmgr.vbs -dlv" indicates running KMS with DNS publishing, but "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SL" is missing, no other suspicious activity (clean startup records; clean running process, verified by processexlorer; no records from antivirus... everything looks good).
- if i delete DNS record and restart sppsvc.exe service, it appears again (according to processexp, slmgr.vbs create this record, but this is not normally) ;
This problem occurs only for some win7 workstations and two clean 2012 servers.
If anyone has any idea on finding the cause of this problem, it will be wonderful.