Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The university I attend scans student and faculty machines with an agent (Bradford) to ensure they comply with policy (i.e. AV is installed and up-to date, and the OS is patched). The system's MAC address is then tied to a user's domain account. Sometime last week, the campus network started claiming that my laptop was unregistered after a reboot.

I contacted a network admin, who discovered that five different MAC addresses had been associated with my laptop's WNIC. Upon further investigation, I discovered that somehow, the last two hex digits of the WNIC MAC that is reported to Windows 7 has started to change after a reboot of the system. I don't use any spoofing software.

Could this be caused by faulty hardware? The MAC prefix (00E04C) does correspond the correct OEM (Realtek). The WNIC is a RTL8723AE. My next step is to see if the same thing occurs when booted to a Linux distro.

share|improve this question

migrated from Feb 20 '13 at 2:16

This question came from our site for information security professionals.

While related to a security function of your university, this sounds more like a system troubleshooting question. It is probably more appropriate for Super User. If you would like it moved, please flag it for the moderators to migrate - do not cross-post. – Iszi Feb 20 '13 at 1:47
I would just pick one and configure the interface to use that one from now on. – David Schwartz Feb 20 '13 at 2:28
@DavidSchwartz, I'm still curious about this. I've never seen anything like what OP reports. Any sane explanation? – vonbrand Feb 20 '13 at 4:18
@DavidSchwartz Unfortunately, the Windows drivers do not offer that setting, and Linux support is practically nonexistent. I'd rather not use a workaround anyway. I've ordered an Intel 6235AN as a replacement, which I should have tomorrow. – Sean W. Feb 20 '13 at 22:02
@vonbrand My first thought was this might be a symptom of some malware (for ARP Spoofing or something). After I got my paranoia in check, I decided that the most likely explanation a failure in the WNIC hardware. I'll post an update once I've replaced it. – Sean W. Feb 20 '13 at 22:14
up vote 0 down vote accepted

I replaced the WNIC, and all is well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.