Just found a fault with a server, other users have had problems connecting to it. The setting on the network card had changed from Private (domain) network to Public (the other option being Home).
The switch to the network interface would have caused the firewall to block a lot of normal functions.
I am guessing that since the event log showed no reason for the change that it might be due to a complete shutdown we had recently where someone powered up the machines, however the domain controllers might not have been booted up first. Any confirmation that this might be the case?
That is likely what happened. Because of the possibility that a given machine can connect to multiple different networks over the course of its life that share the same IP range, but are not the same network, Windows looks for other clues as to the identity of the network. That includes querying the DNS servers.
Now why MS thinks a SERVER would be doing that as opposed to a laptop is anyone's guess.