A KS to monitor the contents of the 1C record of all the production WINS servers and compare the 1C record contents to a known good list of DC's. If any discrepancies are found, an event is generated. In WINS, there is a "1C" record that contains a list of IP addresses that correspond to authorized domain controllers for the domain that the WINS server resides. This list of DC's is given to clients to use for requesting authentication to log on. If any unauthorized IP addresses appear in this list, a "bogus" server may be asked to authenticate users, which would appear as authentication failures.