DHCP

Dynamic Host Configuration Protocol (DHCP) is an IP standard designed to reduce the complexity of administering address configurations by using a server computer to centrally manage IP addresses and other related configuration details used on your network. The Microsoft® Windows® Server 2003 family provides the DHCP service, which enables the server computer to perform as a DHCP server and configure DHCP-enabled client computers on your network as described in the current DHCP draft standard, RFC 2131.

DHCP includes Multicast Address Dynamic Client Assignment Protocol (MADCAP) which is used to perform multicast address allocation. When registered clients are dynamically assigned IP addresses through MADCAP, they can participate efficiently in the data stream process, such as for real-time video or audio network transmissions.

  • Before installing a DHCP or MADCAP server, see Checklists.
  • To find features that have been moved in the Windows Server 2003 family, see New ways to do familiar tasks.
  • For tips about using DHCP, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklists

  • Checklist: Installing a DHCP server
  • Checklist: Administering a DHCP server
  • Checklist: Installing a MADCAP server


Checklist: Installing a DHCP server

Step | Reference
Review DHCP concepts such as scopes, leases, and options.

Important

  • If you are operating in a domain environment under an earlier version of Windows NT Server, it is recommended that you first upgrade your domain controllers to Windows Server 2003 family before installing DHCP on your network.
 DHCP terminology
Determine the IP address range or ranges for which DHCP will be needed to provide configuration service on your network. | Configuring scopes
Manually configure TCP/IP properties for the DHCP server computer. | To configure TCP/IP for static addressing
Install the DHCP server. | To install a DHCP server
Open the DHCP console. | To open the DHCP console
Authorize the DHCP server in Active Directory. | To authorize a DHCP server in Active Directory; Authorizing DHCP servers
If the DHCP server is multihomed, disable service bindings for any connection not to be used to listen and provide service to clients. | To selectively set DHCP server bindings for network connections; Multihomed DHCP servers
Set DNS dynamic update policy for the DHCP server. | To enable DNS dynamic updates for clients; Using DNS servers with DHCP
(Optional) If you are using multiple scopes, configure any default option types for the server that should be inherited by all scopes. Server options are assigned to all DHCP clients that lease an IP address from any scope configured on the server. | To assign a server-based option; Assigning options
Create a new scope and assign commonly used options, such as WINS and DNS servers (unless these are already configured as server options). Scope options are assigned only to DHCP clients that lease an IP address from the scope where the option is configured. | To create a new scope; Configuring scopes; Commonly used options
(Optional) Configure additional scope option types if you have subnets that need option configurations in addition to server options that are already configured. | To assign a scope-based option; Assigning options
(Optional) Add reservations for clients that require a reserved IP address assigned by DHCP. Reservations assure that DHCP clients keep the same IP address and have DHCP options refreshed each time the client renews the IP address lease. | To add a client reservation; Using client reservations
(Optional) Create exclusion ranges to prevent some IP addresses from being leased by the DHCP server. If you have network devices (such as printers, servers, or wireless access points) that must be configured with static IP addresses, create an exclusion range within the scope's address range; you can then assign static addresses to devices from the range of addresses excluded from distribution by the DHCP server. | To exclude an address from a scope
Activate the scope. | To activate a scope
(Optional) For additional fault tolerance, you can implement DHCP clustering support using a server cluster.

Note

  • DHCP clustering servers are implemented using the Clustering service, which is provided only with XOX.
 Cluster support for DHCP servers


Checklist: Administering a DHCP server

The following table lists optional actions you can take to administer your DHCP server, depending on your network configuration.

Step | Reference
If clients share a commonly defined vendor type or a common need for a unique DHCP options configuration, configure and assign option classes. | Using option classes; Manage options and classes
If predefined options do not meet your needs, define additional option types. | To define a new option; Assigning options
If the default lease time of eight days is too long or too short, adjust the length of lease durations. For example, you can shorten leases for wireless clients on wireless subnets, or lengthen leases for subnets whose DHCP clients all have reservations. | To change or view scope properties; Managing leases
If you need to implement support for more than one logical network for each physical network, create and use superscopes. | To create a superscope; Using superscopes
If you have a routed network, determine if you need to implement relay agents or update routers, and if so, review relay agent configurations and related design issues. | DHCP/BOOTP relay agents; Configure the DHCP Relay Agent
If you want to deploy your DHCP server as a multicast server, create multicast scopes. | To create a multicast scope; Using multicast scopes
If you want to support BOOTP clients on your network, configure the BOOTP table. | To add an entry to the BOOTP table; To view the BOOTP table
If DHCP clients have problems accessing network resources, verify DHCP service to clients. | To verify, release, or renew a client address lease; Ipconfig; Command-line utilities
If you want to manually configure IP addresses for clients running Windows 2000, XOX, or Windows Server 2003 family, disable automatic address configuration. | To disable automatic address configuration
If you want to track DHCP server performance, use System Monitor. | Monitoring DHCP server performance; System Monitor
If you want to allow users to have read-only or administrative access to the DHCP server, add users to DHCP groups. | DHCP groups; Default groups
If you are having DHCP-related problems, troubleshoot and resolve common DHCP-related problems, or review DHCP server audit log files. | Troubleshooting; Analyzing server log files


Checklist: Installing a MADCAP server

Step | Reference
Review Multicast Address Dynamic Client Allocation Protocol (MADCAP) concepts such as IP multicasting and multicast address allocation. | Multicast address allocation; Understanding multicasting
Determine the multicast IP address range or ranges for use in your MADCAP server configuration. The ranges you select depend on whether you need to use administrative local scoping or global scoping practices to provide multicast address allocation service on your network. | Determining the ranges to use for multicast scopes
Manually configure TCP/IP properties for the DHCP (MADCAP) server computer. | To configure TCP/IP for static addressing
To install a MADCAP server, install the DHCP service.

Important

  • The DHCP service can be used to deploy MADCAP servers independently of how DHCP servers are used on your network. For example, to install Windows Server 2003 DHCP for MADCAP service only:
    1. Create multicast scopes.
    2. Do not create other scopes or superscopes.

    Only where other scopes or superscopes are configured, does the server computer also function as a DHCP server.

 To install a DHCP server
Open the DHCP console. | To open the DHCP console
Authorize the DHCP (MADCAP) server in Active Directory. | To authorize a DHCP server in Active Directory
(Optional) If the DHCP (MADCAP) server is multihomed, you can disable service bindings for any connection not to be used to listen and provide service to DHCP (MADCAP) clients. | To selectively set DHCP server bindings for network connections; Multihomed DHCP servers
Create a multicast scope. | To create a multicast scope
If necessary, you can additionally manage multicast IP address allocation by creating and removing scopes, or by modifying multicast scope properties, such as scope TTL and lifetime settings as needed. | Manage multicast scopes
(Optional) For additional fault tolerance, you can implement DHCP clustering support using a server cluster.

Note

  • DHCP clustering servers are implemented using the Clustering service, which is provided only with XOX.
 Cluster support for DHCP servers


New ways to do familiar tasks

The following table lists common tasks for managing DHCP servers using the DHCP console. The user interface for performing these tasks is different in this version of Windows from the way it was in Windows NT 4.0.

Note

  • XOX
If you want to | In Windows NT 4.0 use | In this version of Windows use
Install a DHCP server on this computer | Network in Control Panel | Add or Remove Programs For more information, see To install a DHCP server.
Start the DHCP console | Click Start, point to Administrative Tools, and then click DHCP Manager. | The DHCP console. For more information, see To open the DHCP console.
Authorize a DHCP server in Active Directory prior to use | Not available in Windows NT Server 4.0 | Log on first as a user who is a member of the Enterprise Admins group for the enterprise where you need to authorize the server. For more information, see To authorize a DHCP server in Active Directory.
Start or stop a DHCP server | Services in Control Panel | The DHCP console. For more information, see To start or stop a DHCP server.
Add a server to the DHCP console to manage | Server menu in DHCP Manager | The DHCP console. For more information, see To connect to a DHCP server.
Add and configure a scope for a DHCP server | Create option on Scope menu in DHCP Manager | The DHCP console. For more information, see To create a new scope.


Best practices

  • Use the 80/20 design rule for balancing scope distribution of addresses where multiple DHCP servers are deployed to service the same scope.

    Using more than one DHCP server on the same subnet provides increased fault tolerance for servicing DHCP clients located on it. With two DHCP servers, if one server is unavailable, the other server can take its place and continue to lease new addresses or renew existing clients.

    A common practice when balancing a single network and scope range of addresses between two DHCP servers is to have 80 percent of the addresses distributed by one DHCP server and the remaining 20 percent provided by a second. For more information and an example of this concept, see Configuring scopes.

  • Use superscopes for multiple DHCP servers on each subnet in a LAN environment.

    When started, each DHCP client broadcasts a DHCP discover message (DHCPDISCOVER) to its local subnet to attempt to find a DHCP server. Because DHCP clients use broadcasts during their initial startup, you cannot predict which server will respond to the DHCP discover request of a client if more than one DHCP server is active on the same subnet.

    For example, if two DHCP servers service the same subnet and its clients, clients can be leased at either server. Actual leases distributed to clients can depend on which server responds first to any given client. Later, the server first selected by the client to obtain its lease might be unavailable when the client attempts to renew.

    If renewal fails, the client then delays trying to renew its lease until it enters the rebinding state. In this state, the client broadcasts to the subnet to locate a valid IP configuration and continue without interruption on the network. At this point, a different DHCP server might respond to the client request. If this occurs, the responding server might send a DHCP negative acknowledgement message (DHCPNAK) in reply. This can occur even if the original server that first leased the client is available on the network.

    To avoid these problems when using more than one DHCP server on the same subnet, use a new superscope configured similarly at all servers. The superscope should include all valid scopes for the subnet as member scopes. For configuring member scopes at each server, addresses must only be made available at one of the DHCP servers used on the subnet. For all other servers in the subnet, use exclusion ranges for the same scope ranges of addresses when configuring the corresponding scopes.

    For more information, see Using superscopes.

  • Deactivate scopes only when removing a scope permanently from service.

    Once you activate a scope, it should not be deactivated until you are ready to retire the scope and its included range of addresses from use on your network.

    Once a scope is deactivated, the DHCP server no longer accepts those scope addresses as valid addresses. This is only useful when the intention is to permanently retire a scope from use. Otherwise, deactivating a scope causes undesired DHCP negative acknowledgement messages (DHCPNAKs) to be sent to clients.

    If the intent is only to affect temporary deactivation of scope addresses, editing or modifying exclusion ranges in an active scope achieves the intended result without undesired results.

    For more information, see Manage scopes.

  • Use server-side conflict detection on DHCP servers only when it is needed.

    Conflict detection can be used by either DHCP servers or clients to determine whether an IP address is already in use on the network before leasing or using the address.

    DHCP client computers running Windows 2000 or XOX that obtain an IP address use a gratuitous ARP request to perform client-based conflict detection before completing configuration and use of a server offered IP address. If the DHCP client detects a conflict, it will send a DHCP decline message (DHCPDECLINE) to the server.

    If your network includes legacy DHCP clients (clients running a version of Windows earlier than Windows 2000), you can use server-side conflict detection provided by the DHCP Server service under specific circumstances. For example, this feature might be useful during failure recovery when scopes are deleted and recreated. For more information, see Troubleshooting.

    By default, the DHCP service does not perform any conflict detection. To enable conflict detection, increase the number of ping attempts that the DHCP service performs for each address before leasing that address to a client. Note that for each additional conflict detection attempt that the DHCP service performs, additional seconds are added to the time needed to negotiate leases for DHCP clients.

    Typically, if DHCP server-side conflict detection is used, you should set the number of conflict detection attempts made by the server to use one or two pings at most. This provides the intended benefits of this feature without decreasing DHCP server performance.

    For more information, see To enable address conflict detection.

  • Reservations should be created on all DHCP servers that can potentially service the reserved client.

    You can use a client reservation to ensure that a DHCP client computer always receives the same IP address lease at startup. If you have more than one DHCP server reachable by a reserved client, add the reservation at each of your other DHCP servers.

    This allows the other DHCP servers to honor the client IP address reservation made for the reserved client. Although the client reservation is only acted upon by the DHCP server where the reserved address is part of the available address pool, you can create the same reservation on other DHCP servers that exclude this address.

    For more information, see To add a client reservation.

  • For server performance, note that DHCP is disk-intensive and purchase hardware with optimal disk performance characteristics.

    DHCP causes frequent and intensive activity on server hard disks. To provide the best performance, consider RAID solutions when purchasing hardware for your server computer that improves disk access time.

    When evaluating performance of your DHCP servers, you should evaluate DHCP as part of making a full performance evaluation of the entire server. By monitoring system hardware performance in the most demanding areas of utilization (CPU, memory, disk input/output), you obtain the best assessment of when a DHCP server is overloaded or in need of an upgrade.

    Note that the DHCP service includes several System Monitor counters that can be used to monitor service. For more information, see Monitoring DHCP server performance.

  • Keep audit logging enabled for use in troubleshooting.

    By default, the DHCP service enables audit logging of service-related events. Audit logging provides a long-term service monitoring tool that makes limited and safe use of server disk resources. For more information, see Audit logging.

    For more information on interpreting server audit log files, see Analyzing server log files.

  • Reduce lease times for DHCP clients that use Routing and Remote Access service for remote access.

    If Routing and Remote Access service is used on your network to support dial-up clients, you can adjust the lease time on scopes that service these clients to less than the default of eight days. One recommended way to support remote access clients in your scopes is to add and configure the built-in Microsoft vendor class provided for the purpose of client identification.

  • Increase the duration of scope leases for large, stable, fixed networks if available address space is plentiful.

    For small networks (for example, one physical LAN not using routers), the default lease duration of eight days is a typical period. For larger routed networks, consider increasing the length of scope leases to a longer period of time, such as 16-24 days. This can reduce DHCP-related network broadcast traffic, particularly if client computers generally remain in fixed locations and scope addresses are plentiful (at least 20 percent or more of the addresses are still available).

  • Integrate DHCP with other services, such as WINS and DNS.

    WINS and DNS can both be used for registering dynamic name-to-address mappings on your network. To provide name resolution services, you must plan for interoperability of DHCP with these services. Most network administrators implementing DHCP also plan a strategy for implementing DNS and WINS servers.

  • For routed networks, either use relay agents or set appropriate timers to prevent undesired forwarding and relay of BOOTP and DHCP message traffic.

    If you have multiple physical networks connected through routers, and you do not have a DHCP server on each network segment, the routers must be capable of relaying BOOTP and DHCP traffic. If you do not have such routers, you can set up the DHCP Relay Agent component on at least one server running Windows Server 2003 in each routed subnet. The relay agent relays DHCP and BOOTP message traffic between the DHCP-enabled clients on a local physical network and a remote DHCP server located on another physical network.

    When using relay agents, be sure to set the initial time delay in seconds that relay agents wait before relaying messages on to remote servers. For more information on DHCP relay agents, see DHCP/BOOTP relay agents.

  • Use the appropriate number of DHCP servers for the number of DHCP-enabled clients on your network.

    In a small LAN (for example, one physical subnet not using routers), a single DHCP server can serve all DHCP-enabled clients. For routed networks, the number of servers needed increases, depending on several factors, including the number of DHCP-enabled clients, the transmission speed between network segments, the speed of network links, whether DHCP service is used throughout your enterprise network or only on selected physical networks, and the IP address class of the network. For more information on determining how many DHCP servers to set up, see Planning DHCP networks.

  • For DNS dynamic updates performed by the DHCP service, use the default client preference settings.

    The Windows Server 2003 DHCP service can be configured to perform DNS dynamic updates for DHCP clients based on how clients request these updates to be done. This setting provides the best use of the DHCP service to perform dynamic updates on behalf of its clients as follows:

    • DHCP client computers running Windows 2000, XOX, or a Windows Server 2003 operating system explicitly request that the DHCP server only update pointer (PTR) resource records used in DNS for the reverse lookup and resolution of the client's IP address to its name. These clients update their address (A) resource records for themselves.
    • Clients running earlier versions of Windows cannot make an explicit request for DNS dynamic update protocol preference. For these clients, the DHCP service updates both the PTR and the A resource records when the service is configured to do so.

    For more information, see Using DNS servers with DHCP, To enable DNS dynamic updates for clients, and To configure DNS dynamic update credentials.

  • Use the manual backup and restore methods in the DHCP server console.

    Use the Backup command on the Action menu of the DHCP console to perform full backup of the DHCP service at an interval that protects you from significant data loss. When you use the manual backup method, all DHCP server data is included in the backup, including all scope information, log files, registry keys, and DHCP server configuration information (except DNS dynamic update credentials). Do not store these backups on the same hard drive upon which the DHCP service is installed, and make sure that the access control list (ACL) for the backup folder only contains the Administrators group and DHCP Administrator groups as members. In addition to performing manual backups, backup to other locations, such as a tape drive, and make sure unauthorized persons do not have access to your backup copies. You can use Windows Backup for this purpose. For more information, see Best practices for Backup.

    When restoring the DHCP service, use a backup created with the manual Backup command or a copy of the database created with synchronous backup by the DHCP service. In addition, use the Restore command on the Action menu in the DHCP console to restore a DHCP server.

    For more information, see Backing up the DHCP database and Restoring server data.

  • Follow the recommended process for moving a DHCP server database from old server computer hardware to new hardware.

    Moving a DHCP server database can be problematic. To manage moving the server database more easily, choose and follow a process tried and used by Microsoft Product Support Services such as the following:

    • For restoring server data at the same server computer, see Restoring server data.
    • For moving DHCP server data to another server computer, such as in the case of hardware failure or data recovery, see To move a DHCP database to another server.
  • Before you install a DHCP server, identify the following:
    • The hardware and storage requirements for the DHCP server.

      For more information, see Planning DHCP networks.

    • Which computers you can immediately configure as DHCP clients for dynamic TCP/IP configuration and which computers you should manually configure with static TCP/IP configuration parameters, including static IP addresses.

      For more information, see Checklist: Installing and configuring TCP/IP.

    • The DHCP option types and their values to be predefined for DHCP clients.

      For more information, see Assigning options.


How to...

  • Use DHCP client alternate configuration
  • Install and administer servers
  • Manage server access
  • Monitor and configure servers
  • Manage scopes
  • Manage superscopes
  • Manage multicast scopes
  • Manage options and classes
  • Manage clients and leases
  • Manage reservations and reserved clients
  • Manage databases
  • Manage BOOTP and remote access clients
  • Use DHCP command-line tools


Use DHCP client alternate configuration

Microsoft Windows Graphic

To use DHCP client alternate configuration

  1. Open Network Connections.
  2. Right-click the network connection that you want to configure, and then click Properties.
    3. The Local Area Connection Properties dialog box appears.
  3. On the General tab, click Internet Protocol (TCP/IP), and then click Properties. The Internet Protocol (TCP/IP) Properties dialog box appears.
  4. On the General tab, click Obtain an IP address automatically.
  5. Click the Alternate Configuration tab, and then click User configured.
  6. In IP address and Subnet mask, type an IP address and subnet mask.
  7. You can perform any of the following optional tasks:
    • In Default gateway, type the default gateway address.
    • In Preferred DNS server, type the primary Domain Name Service (DNS) server address.
    • In Alternate DNS server, type the secondary DNS server address.
    • In Preferred WINS server, type the primary Windows Internet Name Service (WINS) server address.
    • In Alternate WINS server, type the secondary WINS server address.

Note

  • XOX

Related Topics


Install and administer servers

  • Install a DHCP server
  • Open the DHCP console
  • Connect to a DHCP server
  • Disconnect from a DHCP server
  • Start or stop a DHCP server
  • Reconcile the DHCP database
  • Remove or uninstall DHCP


Install a DHCP server

Microsoft Windows Graphic

To install a DHCP server

  1. Open Windows Components Wizard.
  2. Under Components, scroll to and click Networking Services.
  3. Click Details.
  4. Under Subcomponents of Networking Services, click Dynamic Host Configuration Protocol (DHCP), and then click OK.
  5. Click Next. If prompted, type the full path to the Windows Server 2003 distribution files, and then click Next.

    Required files are copied to your hard disk.

Notes

  • XOX
  • DHCP servers must be configured with a static IP address.

Related Topics


Open the DHCP console

Microsoft Windows Graphic

To open the DHCP console

  • Open DHCP.

Notes

  • XOX
  • The DHCP console is an administrative tool for managing DHCP servers. For more information, see Related Topics.

Related Topics


Connect to a DHCP server

Microsoft Windows Graphic

To connect to a DHCP server

  1. Open DHCP.
  2. In the console tree, click DHCP.
  3. On the Action menu, click Add Server.
  4. In the Add Server dialog box, do one of the following:
    • Click This server, enter the name of the DHCP server that you want to connect to, and then click OK.
    • Click This authorized DHCP server, click the DHCP server that you want to connect to, and then click OK.

Notes

  • XOX
  • If you are operating DHCP in an Active Directory environment and are connecting to a server for the first time, you need to first authorize the new DHCP server in the directory service. For more information, see Related Topics.
  • If DHCP is installed and running on this computer, you do not need to make a manual connection using the wizard. In most cases, the local DHCP server automatically appears in the list of servers when the DHCP console starts, and you connect to the server by clicking it in the console tree.
  • Only users belonging to the following groups can connect to a DHCP server:
    • DHCP Users
    • DHCP Administrators
    • Domain Admins
    • Enterprise Admins

Related Topics


Disconnect from a DHCP server

Microsoft Windows Graphic

To disconnect from a DHCP server

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Delete.
  4. When prompted to confirm removing the server, click Yes.

Note

  • XOX

Related Topics


Start or stop a DHCP server

Microsoft Windows Graphic

To start or stop a DHCP server

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, point to All Tasks and then click one of the following:
    • To start the service, click Start.
    • To stop the service, click Stop.
    • To interrupt the service, click Pause.
    • To stop and then automatically restart the service, click Restart.

Notes

  • XOX
  • After you pause or stop the server, the Resume option appears and can be clicked to immediately resume service.
  • You can also perform these tasks at a command prompt by using the following commands:
    • net start dhcpserver
    • net stop dhcpserver
    • net pause dhcpserver
    • net continue dhcpserver
  • You can also perform these tasks at the netsh> command prompt or in a script using the Netsh commands for DHCP. For more information, see Related Topics.

Related Topics


Reconcile the DHCP database

Microsoft Windows Graphic

To reconcile the DHCP database

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Reconcile All Scopes.
  4. In the Reconcile All Scopes dialog box, click Verify.

    Inconsistencies found are reported in the status window.

  5. If the database is found to be consistent, click OK.

    If the database is not consistent, click the displayed addresses that need to be reconciled, and click Reconcile to repair inconsistencies.

Notes

  • XOX
  • For more information, see Related Topics.

Related Topics


Remove or uninstall DHCP

Microsoft Windows Graphic

To remove or uninstall DHCP

  1. If necessary, stop the DHCP server on this computer.

    For more information, see Related Topics.

  2. Open Windows Components Wizard.
  3. Under Components, scroll to and click Networking Services.
  4. Click Details.
  5. In Subcomponents of Networking Services, scroll to Dynamic Host Configuration Protocol (DHCP) and clear the check box.

Notes

  • XOX
  • When you remove DHCP, all DHCP files are deleted from the server except program files that are in use. When the system is restarted, these files are removed as well.
  • If you do not stop the DHCP Server service in step 1, this procedure only deletes the DHCP server registry entries.

Related Topics


Manage server access

  • Authorize a DHCP server in Active Directory
  • Unauthorize a DHCP server in Active Directory
  • Delegate ability to authorize DHCP servers to a non-enterprise administrator
  • Selectively set DHCP server bindings for network connections
  • Add a user or group as a DHCP user at a member server
  • Add a user or group as a DHCP user at a domain controller
  • Add a user or group as a DHCP administrator at a member server
  • Add a user or group as a DHCP administrator at a domain controller


Authorize a DHCP server in Active Directory

Microsoft Windows Graphic

To authorize a DHCP server in Active Directory

  1. Open DHCP.
  2. In the console tree, click DHCP.
  3. On the Action menu, click Manage authorized servers.

    The Manage Authorized Servers dialog box appears.

  4. Click Authorize.
  5. When prompted, type the name or IP address of the DHCP server to be authorized, and then click OK.

Notes

  • For a DHCP server to be authorized in an Active Directory domain environment, you must first be logged on as a member of the Enterprise Admins group for the enterprise where the server is being added.
  • XOX
  • This procedure is usually only needed if you are running a DHCP server on a member server. In most cases, if you are installing a DHCP server on a computer also running as a domain controller, the server is automatically authorized the first time you add the server to the DHCP console.
  • The fully qualified domain name (FQDN) of the DHCP server cannot exceed 64 characters. If the FQDN of the DHCP server exceeds 64 characters, the attempt to authorize the server fails with the error message, "A constraint violation has occurred." If your DHCP server FQDN exceeds 64 characters, authorize the server using the IP address of the server instead of its FQDN.
  • DHCP servers running Windows 2000 cannot be authorized using the Windows Server 2003 administrative tools (the DHCP console and the Netsh commands for DHCP) unless Windows 2000 Server Service Pack 2 is installed.

Related Topics


Unauthorize a DHCP server in Active Directory

Microsoft Windows Graphic

To unauthorize a DHCP server in Active Directory

  1. Open DHCP.
  2. In the console tree, click DHCP.
  3. On the Action menu, click Manage authorized servers.

    The Manage Authorized Servers dialog box appears.

  4. In Authorized DHCP servers, select the server you want to unauthorize.
  5. Click Unauthorize.

Notes

  • XOX
  • Removing authorization for a DHCP server from the directory causes that server to stop responding to client requests.
  • If the server you unauthorize is the only DHCP server, clients will be unable to obtain IP address leases through DHCP.

Related Topics


Delegate ability to authorize DHCP servers to a non-enterprise administrator

Microsoft Windows Graphic

To delegate ability to authorize DHCP servers to a non-enterprise administrator

  1. Open Active Directory Sites and Services while logged on as an enterprise administrator.

    For more information, see Notes.

  2. On the View menu, click Show Services Node.
  3. In the console tree, click NetServices.

    Where?

    • Active Directory Sites and Services
    • Services
    • NetServices
  4. On the Action menu, click Delegate Control.
  5. In the Delegation of Control Wizard, click Next.
  6. On the Users or Groups page, click Add.
  7. In the Select Users, Computers, or Groups dialog box, under Enter the object names to select, type the name of the user you want to add to the DHCP Administrators group, and then click OK. To add multiple users in one operation, type user names separated by semicolons, and then click OK. When you finish adding users, click Next.
  8. On the Tasks to Delegate page, click Create a custom task to delegate, and then click Next.
  9. On the Active Directory Object Type page, under Delegate control of, click This folder, existing objects in this folder, and creation of new objects in this folder, and then click Next.
  10. On the Permissions page, under Permissions, select the Full Control check box, and then click Next.

    This enables access control rights to the user or group account that you delegated in this procedure so that the user or group can add, modify, or delete new objects of DHCP class type in the NetServices folder.

Notes

  • To be logged on as an enterprise administrator, you must log on using a member account in the Enterprise Admins group. By default, this can typically be done by logging on as local administrator at the first domain controller created in your enterprise.
  • XOX
  • For more information on setting permissions, see Related Topics.

Related Topics


Selectively set DHCP server bindings for network connections

Microsoft Windows Graphic

To selectively set DHCP server bindings for network connections

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. Click the Advanced tab.
  5. Click Bindings.
  6. In the Bindings dialog box, for the list of Connections and server bindings, select or clear check boxes for any statically configured network connections that should be enabled or disabled for use at the applicable DHCP server. Click OK.
  7. On the Advanced tab, click Apply.

Notes

  • XOX
  • If a network connection has more than one IP address configured, only the first configured IP address is used or affected by the DHCP server bindings. Any additional configured IP addresses are not used or configurable for bindings and are never used to service clients.
  • The DHCP Server service never binds to any wide area network (WAN) or DHCP-enabled network connections on a server computer. For this reason, these connections do not appear in the Bindings dialog box.

Related Topics


Add a user or group as a DHCP user at a member server

Microsoft Windows Graphic

To add a user or group as a DHCP user at a member server

  1. Open Computer Management if the DHCP server is installed as a domain member server (or a stand-alone workgroup server).
  2. In the console tree, click Local Users and Groups.

    Where?

    • Computer Management (Local)
    • System Tools
    • Local Users and Groups
  3. In the details pane, double-click Groups, and then click DHCP Users.
  4. On the Action menu, click Properties.
  5. On the General tab, click Add.

    The Select Users dialog box opens.

  6. In Enter the object names to select, type the name of the user you want to add as a DHCP User, and then click OK. To add multiple users in one operation, type user names separated by semicolons, and then click OK.

Notes

  • XOX
  • The DHCP Users group provides a way to grant read-only console access to the DHCP server. Members of DHCP Users group are granted the right to view, but not to modify, data for the applicable server in the DHCP console. For more information about DHCP groups, see Related Topics.

Related Topics


Add a user or group as a DHCP user at a domain controller

Microsoft Windows Graphic

To add a user or group as a DHCP user at a domain controller

  1. Open Active Directory Users and Computers if the DHCP server is installed at a domain controller.
  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers
    • applicable domain
    • Users
  3. In the details pane, click DHCP Users.
  4. On the Action menu, click Properties.
  5. Click the Members tab, and then click Add.

    The Select Users dialog box opens.

  6. In Enter the object names to select, type the name of the user you want to add as a DHCP User, and then click OK. To add multiple users in one operation, type user names separated by semicolons, and then click OK.

Notes

  • XOX
  • The DHCP Users group provides a way to grant read-only console access to the DHCP server. Members of DHCP Users group are granted the right to view, but not to modify, data for the applicable server in the DHCP console. For more information about DHCP groups, see Related Topics.

Related Topics


Add a user or group as a DHCP administrator at a member server

Microsoft Windows Graphic

To add a user or group as a DHCP administrator at a member server

  1. Open Computer Management if the DHCP server is installed as a domain member server (or a stand-alone workgroup server).
  2. In the console tree, click Local Users and Groups.

    Where?

    • Computer Management (Local)
    • System Tools
    • Local Users and Groups
  3. In the details pane, double-click Groups, and then click DHCP Administrators.
  4. On the Action menu, click Properties, and then click Add.
  5. In Enter the object names to select, type the name of the user you want to add as a DHCP Administrator, and then click OK. To add multiple users in one operation, type user names separated by semicolons, and then click OK.

Notes

  • XOX
  • The DHCP Administrators group provides a way to grant limited administrative access to the DHCP server. Members of the DHCP Administrators group are granted the right to fully administer the applicable server using DHCP tools (the DHCP console and Netsh commands for DHCP); they do not have access to other services running on the server and are not able to perform other administrative actions on the server computer. For more information about DHCP groups, see Related Topics.

Related Topics


Add a user or group as a DHCP administrator at a domain controller

Microsoft Windows Graphic

To add a user or group as a DHCP administrator at a domain controller

  1. Open Active Directory Users and Computers if the DHCP server is installed at a domain controller.
  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers
    • applicable domain
    • Users
  3. In the details pane, click DHCP Administrators.
  4. On the Action menu, click Properties.
  5. Click the Members tab, and then click Add.

    The Select Users dialog box opens.

  6. In Enter the object names to select, type the name of the user you want to add as a DHCP Administrator, and then click OK. To add multiple users in one operation, type user names separated by semicolons, and then click OK.

Notes

  • XOX
  • The DHCP Administrators group provides a way to grant limited administrative access to the DHCP server. Members of the DHCP Administrators group are granted the right to fully administer the applicable server using DHCP tools (the DHCP console and Netsh commands for DHCP); they do not have access to other services running on the server and are not able to perform other administrative actions on the server computer. For more information about DHCP groups, see Related Topics.

Related Topics


Monitor and configure servers

  • Configure DNS dynamic update credentials
  • Enable server statistics to automatically refresh
  • Enable DHCP server logging
  • Enable address conflict detection
  • Enable DNS dynamic updates for clients
  • Manually refresh server statistics
  • View DHCP server statistics
  • View DHCP server properties


Configure DNS dynamic update credentials

Microsoft Windows Graphic

To configure DNS dynamic update credentials

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. In Server Properties, click the Advanced tab, and then click Credentials.

    The DNS dynamic update credentials dialog box appears.

  5. In DNS dynamic update credentials, type the information required to provide credentials that will determine DNS record ownership, and then click OK.

Notes

  • XOX
  • If the supplied credentials belong to an object (such as a computer) that is a member of the DnsUpdateProxy security group, the next object to register the same name record in DNS will become the record owner.
  • If you specified the credentials (user name, domain, and password) that the DHCP server uses when registering DHCP client computers in DNS, these credentials are not backed up with either synchronous or asynchronous backup. After a DHCP database is restored, new credentials must be configured.

Related Topics


Enable server statistics to automatically refresh

Microsoft Windows Graphic

To enable server statistics to automatically refresh

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. On the General tab, for Automatically update statistics every, specify the number of hours and minutes to use as a refresh interval, and then click OK.

Note

  • XOX

Related Topics


Enable DHCP server logging

Microsoft Windows Graphic

To enable DHCP server logging

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. On the General tab, select Enable DHCP audit logging, and then click OK.

Note

  • XOX

Related Topics


Enable address conflict detection

Microsoft Windows Graphic

To enable address conflict detection

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. Click the Advanced tab.
  5. For Conflict detection attempts, type a number greater than 0 (zero) and less than six, and then click OK.

    The number you type determines how many times the DHCP server tests an IP address before leasing it to a client.

Notes

  • XOX
  • When conflict detection attempts are set, the DHCP server uses the Packet Internet Groper (ping) process to test available scope IP addresses before including these addresses in DHCP lease offers to clients.
  • A successful ping means the IP address is in use on the network. Therefore, the DHCP server does not offer to lease the address to a client. If the ping request fails and times out, the IP address is not in use on the network. In this case, the DHCP server offers to lease the address to a client.
  • Each additional conflict detection attempt delays the DHCP server response by a second while waiting for the ping request to time out. This increases the load on the server. A value of no greater than two (2) for ping attempts is recommended.

Related Topics


Enable DNS dynamic updates for clients

Microsoft Windows Graphic

To enable DNS dynamic updates for clients

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. Click the DNS tab.
  5. Select the Enable DNS dynamic updates according to the settings below check box.
  6. If needed, modify other DNS update settings.

    To view a description of a dialog box item, right-click the item, and then click What's This?

Notes

  • XOX
  • DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system explicitly request that the DHCP server update only the pointer (PTR) resource records that are used in DNS for the reverse lookup and resolution of the IP address of the client to the name of the client. These clients update their address (A) resource records for themselves.
  • Clients running earlier versions of Windows cannot make an explicit request for DNS dynamic update protocol preference. For these clients, the DHCP service updates both the PTR and the A resource records.
  • For more information, see Related Topics.

Related Topics


Manually refresh server statistics

Microsoft Windows Graphic

To manually refresh server statistics

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Display Statistics.
  4. In the Server Statistics dialog box, click Refresh.

Note

  • XOX

Related Topics


View DHCP server statistics

Microsoft Windows Graphic

To view DHCP server statistics

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Display Statistics.

Note

  • XOX

Related Topics


View DHCP server properties

Microsoft Windows Graphic

To view DHCP server properties

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. View or modify server properties as needed.

    To view a description of a dialog box item, right-click the item, and then click What's This?

Note

  • XOX

Related Topics


Manage scopes

  • Create a new scope
  • Remove a scope
  • Exclude an address from a scope
  • Activate a scope
  • Deactivate a scope
  • Change or view scope properties
  • Reconcile a scope


Create a new scope

Microsoft Windows Graphic

To create a new scope

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click New Scope.
  4. Follow the instructions in the New Scope Wizard.

Notes

  • XOX
  • Before you create the scope, determine starting and ending IP addresses to be used within it.
  • Depending on the starting and ending IP addresses for your scope, the DHCP console suggests a default subnet mask useful for most networks. If you know a different subnet mask is required for your network, you can modify the value as needed.
  • When you finish creating a new scope, you might need to complete additional tasks, such as activating the scope for use or assigning scope options.

Related Topics


Remove a scope

Microsoft Windows Graphic

To remove a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Delete.
  4. When prompted, click Yes to delete the scope.

Important

  • Before removing a scope, be sure to have deactivated the scope long enough to migrate clients to a different scope. To migrate clients, either wait for 50% of the configured scope lease time to elapse or manually renew clients in another active scope. Once all clients have been moved or forced to seek leases in another scope, you can safely remove the inactive scope.

Note

  • XOX

Related Topics


Exclude an address from a scope

Microsoft Windows Graphic

To exclude an address from a scope

  1. Open DHCP.
  2. In the console tree, click Address Pool.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Address Pool
  3. On the Action menu, click New Exclusion Range.
  4. In the Add Exclusion dialog box, type the Start IP address that you want to exclude from this scope.

    To exclude a range of more than one IP address, type an End IP address.

  5. Click Add.

Notes

  • XOX
  • Addresses that are excluded from the scope are not offered by the DHCP server to clients obtaining leases from this scope.

Related Topics


Activate a scope

Microsoft Windows Graphic

To activate a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Activate.

Notes

  • XOX
  • Activating a scope is needed only for new scopes to start lease distribution. You must activate a scope to make it available for DHCP clients.
  • Do not activate a scope until you specify the options you want.
  • The Action menu command changes to Deactivate when the selected scope is currently activated. Do not deactivate a scope unless you are retiring it permanently from use on your network.

Related Topics


Deactivate a scope

Microsoft Windows Graphic

To deactivate a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Deactivate.

Important

  • Do not use Deactivate to pause a scope. Instead, adjust the available scope address range by setting exclusions for scope addresses.
  • The Action menu command name changes to Activate when the selected scope is currently deactivated.

Note

  • XOX

Related Topics


Change or view scope properties

Microsoft Windows Graphic

To change or view scope properties

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Properties.
  4. View or modify scope properties as needed.

    To view a description of a dialog box item, right-click the item, and then click What's This?

Note

  • XOX

Related Topics


Reconcile a scope

Microsoft Windows Graphic

To reconcile a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Reconcile.
  4. In the Reconcile dialog box, click Verify.

    Inconsistencies found are reported in the status window.

  5. If the scope is found to be consistent, click OK.

    If the scope is not consistent, select the displayed addresses that need to be reconciled, and click Reconcile to repair inconsistencies.

Notes

  • XOX
  • For more information, see Related Topics.

Related Topics


Manage superscopes

  • Create a superscope
  • Remove a superscope
  • Add a scope to a superscope
  • Activate a superscope
  • Deactivate a superscope


Create a superscope

Microsoft Windows Graphic

To create a superscope

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click New Superscope.

    This menu option only appears if at least one scope, that is not currently part of a superscope, has been created at the server.

  4. Follow the instructions in the New Superscope Wizard.

Notes

  • XOX
  • A superscope can have scopes added to it, either during or after its creation.
  • Scopes that are contained within superscopes are sometimes called child scopes or member scopes.

Related Topics


Remove a superscope

Microsoft Windows Graphic

To remove a superscope

  1. Open DHCP.
  2. In the console tree, click the applicable superscope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope
  3. On the Action menu, click Delete.
  4. When prompted, click Yes to delete the superscope.

Notes

  • XOX
  • Removing a superscope does not remove any of the scopes included in it.

Related Topics


Add a scope to a superscope

Microsoft Windows Graphic

To add a scope to a superscope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable scope
  3. On the Action menu, click Add To Superscope.
  4. In the Available superscopes list, click the superscope to which you want to add this scope.

Notes

  • XOX
  • In order to complete this procedure, at least one superscope must already exist at the applicable DHCP server.

Related Topics


Activate a superscope

Microsoft Windows Graphic

To activate a superscope

  1. Open DHCP.
  2. In the console tree, locate the applicable superscope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope
  3. On the Action menu, click Activate.

Notes

  • XOX
  • Activating a superscope is needed only for new superscopes. When you activate a superscope, it activates all member scopes in the superscope, allowing the DHCP server to lease IP addresses from the superscope to clients on your network. You must activate a superscope to make IP addresses for all of its member scopes available for use by DHCP clients.
  • Do not activate a superscope until you specify the options you want for each of its member scopes.
  • The Action menu command changes to Deactivate when the selected scope is currently activated. Do not deactivate a superscope unless you intend to permanently retire all of its member scopes from use on your network.

Related Topics


Deactivate a superscope

Microsoft Windows Graphic

To deactivate a superscope

  1. Open DHCP.
  2. In the console tree, click the applicable superscope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope
  3. On the Action menu, click Deactivate.

Important

  • The Action menu command name changes to Activate when the selected superscope is currently deactivated.

Note

  • XOX

Related Topics


Manage multicast scopes

  • Create a multicast scope
  • Remove a multicast scope
  • Set the multicast scope Time-To-Live (TTL) value
  • Specify a finite lifetime for a multicast scope


Create a multicast scope

Microsoft Windows Graphic

To create a multicast scope

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click New Multicast Scope.
  4. Follow the instructions in the New Multicast Scope Wizard.

Note

  • XOX

Related Topics


Remove a multicast scope

Microsoft Windows Graphic

To remove a multicast scope

  1. Open DHCP.
  2. In the console tree, click the applicable multicast scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable multicast scope
  3. On the Action menu, click Delete.
  4. When prompted, click Yes to remove the multicast scope.

Notes

  • XOX
  • Removing a multicast scope does not necessarily stop the use of multicast groups associated with scope addresses on your network.
  • If computers on your network are configured by means other than DHCP to use these same addresses, the multicast group might still be used even after this procedure is complete.

Related Topics


Set the multicast scope Time-To-Live (TTL) value

Microsoft Windows Graphic

To set the multicast scope Time-To-Live (TTL) value

  1. Open DHCP.
  2. In the console tree, click the applicable multicast scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable multicast scope
  3. On the Action menu, click Properties.
  4. In Time to live, specify a new value.

Notes

  • XOX
  • The multicast Time-To-Live (TTL) value specifies the number of routers (hops) that multicast traffic is permitted to pass through before expiring on the network. For each router (hop), the original specified TTL is decremented by one (1). When its TTL reaches a value of zero (0), each multicast datagram expires and is no longer forwarded through the network to other subnets.

Related Topics


Specify a finite lifetime for a multicast scope

Microsoft Windows Graphic

To specify a finite lifetime for a multicast scope

  1. Open DHCP.
  2. In the console tree, click the applicable multicast scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable multicast scope
  3. On the Action menu, click Properties.
  4. Click the Lifetime tab.
  5. For Multicast scope lifetime, click Multicast scope expires on.
  6. Using the controls, specify a date and time when the multicast scope is to be expired and removed from the applicable DHCP server.

Notes

  • XOX
  • By default, multicast scopes do not expire. When created, they exist until they are manually removed. This procedure, however, can be used to provide a means of having the DHCP server automatically remove the multicast scope at an appointed future date and time.

Related Topics


Manage options and classes

  • Assign a server-based option
  • Assign a scope-based option
  • Assign an advanced (class-based) option
  • Create a new user or vendor class
  • Define a new option
  • Modify an option
  • Remove an option


Assign a server-based option

Microsoft Windows Graphic

To assign a server-based option

  1. Open DHCP.
  2. In the console tree, click Server Options.

    Where?

    • DHCP
    • applicable DHCP server
    • Server Options
  3. On the Action menu, click Configure Options.
  4. In list of Available Options, select the check box for the first option you want to configure.
  5. Under Data entry, type the information required for this option.
  6. Repeat the two previous steps for any other server options you want to specify, and then click OK.
  7. In addition, you can click the Advanced tab and specify additional server options to be applied only for members of select user or vendor classes.

    Options assigned at this level are only provided to clients identified as members of the classes specified at this tab.

Notes

  • XOX
  • Server options are inherited as default values for all scopes created at the applicable DHCP server. Option values you configure here are overridden by any scope-based or client-based values assigned for the same options.

Related Topics


Assign a scope-based option

Microsoft Windows Graphic

To assign a scope-based option

  1. Open DHCP.
  2. In the console tree, click Scope Options.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Scope Options
  3. On the Action menu, click Configure Options.
  4. In list of Available Options, select the check box for the first option you want to configure.
  5. Under Data entry, type the information required for this option.
  6. Repeat the two previous steps for any other server options you want to specify, and then click OK.
  7. In addition, you can click the Advanced tab and specify additional scope options to be applied only for members of select user or vendor classes.

    Options assigned at this level are only provided to clients identified as members of the classes specified at this tab.

Notes

  • XOX
  • Scope options are inherited as default values for all clients of the applicable scope. Option values you configure here are overridden by any reserved client-based values assigned for the same options.

Related Topics


Assign an advanced (class-based) option

Microsoft Windows Graphic

To assign an advanced (class-based) option

  1. Open DHCP.
  2. In the console tree, choose one:
    • Click Server Options, if you want to assign advanced options for use by all new scopes at the DHCP server.

      Where?

      • DHCP
      • applicable DHCP server
      • Server Options
    • Click Scope Options, if you want to assign advanced options for use by a specific scope at the DHCP server.

      Where?

      • DHCP
      • applicable DHCP server
      • applicable superscope (if used)
      • applicable scope
      • Scope Options
  3. Right-click the folder, and click Configure Options.
  4. Click the Advanced tab.
  5. Select from the following:
    • For Vendor class, scroll to select the defined vendor class at the DHCP server (or use the default, DHCP Standard Options) for assigning options for the server or scope.
    • For User class, scroll to select the defined user class at the DHCP server (or use the default, Default User Class) for assigning options for the server or scope.
  6. In the list of Available Options, select the check box for the first option you want to configure.
  7. Under Data entry, type the information required for this option.
  8. Repeat the two previous steps for any other options you want to specify, and then click OK.

Notes

  • XOX
  • If a class-based option is assigned, it only applies to DHCP clients that are identified as members of the specified user or vendor class.

Related Topics


Create a new user or vendor class

Microsoft Windows Graphic

To create a new user or vendor class

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, choose one of the following:
    • To create a new user class, click Define User Classes.
    • To create a new vendor class, click Define Vendor Classes.
  4. Click Add.
  5. In New Class, type the required information.

    To view a description of a dialog box item, right-click the item, and then click What's This?.

Notes

  • XOX
  • In the DHCP User Classes and DHCP Vendor Classes dialog boxes, you can also click either Edit or Remove to modify or delete option classes.
  • In the New Class dialog box, for ID, set the same binary or ASCII string that matches the DHCP class ID string which is either implemented or set at member clients.
  • You can use the ipconfig /showclassid command to display all the DHCP class IDs allowed for any network adapter installed on your computer.
  • For DHCP client computers running Windows 2000 or XOX, the ipconfig /setclassid command can be used to set the specified DHCP class ID string. For more information, see Related Topics.

Related Topics


Define a new option

Microsoft Windows Graphic

To define a new option

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Set Predefined Options.
  4. In Predefined Options and Values, click Add.
  5. In Option Type, type the required information to define the new option, and then click OK.

    To view a description of a dialog box item, right-click the item, and then click What's This?.

Notes

  • XOX
  • By default, standard DHCP options and BOOTP extensions as described in RFC 2132 are predefined for use at DHCP servers running Windows Server 2003. For more information, see Related Topics.

Related Topics


Modify an option

Microsoft Windows Graphic

To modify an option

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Set Predefined Options.
  4. In Predefined Options and Values, select the following:
    • For Option class, select the class where the option to be modified is used.
    • For Option name, scroll to select the option you want to modify.
  5. Click Edit.
  6. Modify the Name and Description fields for the option as needed.

Notes

  • XOX
  • For options already defined, only the Name and Description fields can be modified using this procedure. To change other fields (such as Data type, Code, or the applicable class where the option is used), the existing option must be removed and a new option defined.
  • By default, standard DHCP options and BOOTP extensions as described in RFC 2132 are predefined for use at DHCP servers running Windows Server 2003. For more information, see Related Topics.

Related Topics


Remove an option

Microsoft Windows Graphic

To remove an option

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Set Predefined Options.
  4. In Predefined Options and Values, select the following:
    • For Option class, select the class where the option to be removed is used.
    • For Option name, scroll to select the user-defined option you want to remove.
  5. Click Delete.

Notes

  • XOX
  • By default, standard DHCP options and BOOTP extensions as described in RFC 2132 are predefined at DHCP servers running Windows Server 2003 for use and cannot be removed using this procedure. For more information, see Related Topics.

Related Topics


Manage clients and leases

  • View client lease information
  • Delete a client lease
  • Verify, release, or renew a client address lease
  • Set DHCP class ID information at a client computer
  • Show DHCP class ID information at a client computer


View client lease information

Microsoft Windows Graphic

To view client lease information

  1. Open DHCP.
  2. In the console tree, click Address Leases.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Address Leases
  3. In the details pane, locate the client lease for which you want to view information.

Notes

  • XOX
  • For most clients displayed in the DHCP console, you cannot edit the displayed lease information. Only reserved scope clients permit some of this information to be edited.

Related Topics


Delete a client lease

Microsoft Windows Graphic

To delete a client lease

  1. Open DHCP.
  2. In the console tree, click Address Leases.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Address Leases
  3. In the details pane, click the IP address of the client you want to delete.
  4. On the Action menu, click Delete.
  5. Make a reservation with the IP address, or exclude it from the range.
  6. Force the client with the existing lease to give it up. At the command prompt on the client computer, type ipconfig /release.
  7. If needed, give the client a new IP address. At the command prompt on the client computer, type ipconfig /renew.

Notes

  • XOX
  • If you want, you can cancel leases for all clients in the scope. To cancel all current leases, select all of the clients in Address Leases, right-click, and then click Delete.
  • Deleting a client lease does not prevent the server from offering that IP address again in a future client lease. It also does not prevent the client from requesting the address again, unless steps 5 to 7 are followed.

Related Topics


Verify, release, or renew a client address lease

Microsoft Windows Graphic

To verify, release, or renew a client address lease

  1. At a DHCP-enabled client computer running XOX or a member of Windows Server 2003 family, open a Command Prompt.
  2. Use the Ipconfig command-line utility to verify, release, or renew the lease of the client with a DHCP server, as follows:
    • To verify a DHCP client lease, type ipconfig to view lease-status information.

      Or, type ipconfig /all.

    • To release a DHCP client lease, type ipconfig /release.
    • To renew a DHCP client lease, type ipconfig /renew.

Note

  • XOX

Related Topics


Set DHCP class ID information at a client computer

Microsoft Windows Graphic

To set DHCP class ID information at a client computer

  1. At a DHCP-enabled client computer running XOX, open a Command Prompt.
  2. Use the Ipconfig command-line utility to set the DHCP class ID the client uses when obtaining its lease from the DHCP server.

    You can type the ipconfig /setclassid command as demonstrated in the following example command, which sets an ASCII string ("MyNewClassId") as the DHCP class ID string for the local area network connection in use at the client computer:

    C:\>ipconfig /setclassid "Local Area Connection" MyNewClassId

XOX IP Configuration

        DHCP ClassId successfully modified for adapter"Local Area Connection"

Notes

  • XOX
  • You can use the ipconfig /showclassid command to display all the DHCP class IDs allowed for any network adapter installed on your computer.
  • For a DHCP options class to be in effect between the DHCP server and its clients, both must be configured with a matching DHCP class ID string that identifies the client as a member of a specific user or vendor options class when it obtains its address lease from the server.
  • For more information, see Related Topics.

Related Topics


Show DHCP class ID information at a client computer

Microsoft Windows Graphic

To show DHCP class ID information at a client computer

  1. At a DHCP-enabled client computer running XOX or Windows 2000, open a Command Prompt.
  2. Use the Ipconfig command-line utility to show the DHCP class ID that the client uses when obtaining its lease from the DHCP server.

    You can type the ipconfig /showclassid command as demonstrated in the following example command. This example shows an ASCII string ("MyNewClassId") that is currently set as the DHCP class ID for the local area network connection at the client computer:

    C:\>ipconfig /showclassid "Local Area Connection"

XOX IP Configuration

DHCP Class ID for Adapter "Local Area Connection":
        DHCP ClassID Name . . . . . . . . : Default BOOTP Class
        DHCP ClassID Description  . . . . : User class for BOOTP clients
        DHCP ClassID Name . . . . . . . . : Default Remote Access Class
        DHCP ClassID Description  . . . . : User class for remote access clients

        Host Name . . . . . . . . . . . . : HOSTA
        Primary DNS Suffix  . . . . . . . : example.microsoft.com
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Combo PCMCIA EthernetCard
        Physical Address. . . . . . . . . : 00-00-00-00-7C-DC
        DHCP Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 10.0.0.51
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.0.0.1
        DHCP Class ID . . . . . . . . . . : MyNewClassId
        DNS servers . . . . . . . . . . . : 10.0.0.3
        Primary WINS server . . . . . . . : 10.0.0.5

Notes

  • XOX
  • For a DHCP options class to be in effect between the DHCP server and its clients, both must be configured with a matching DHCP class ID string that identifies the client as a member of a specific user or vendor options class when it obtains its address lease from the server.
  • For more information, see Related Topics.

Related Topics


Manage reservations and reserved clients

  • Add a client reservation
  • Change information for a reserved client
  • Assign an option to a reserved client
  • Configure advanced (class-based) options for a reserved client
  • Change the reserved IP address for a client


Add a client reservation

Microsoft Windows Graphic

To add a client reservation

  1. Open DHCP.
  2. In the console tree, click Reservations.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Reservations
  3. On the Action menu, click New Reservation.
  4. In New Reservation, type the information required to complete the client reservation.

    To view a description of a dialog box item, right-click the item, and then click What's This?.

  5. To add the client reservation to the scope, click Add.
  6. Repeat the two previous steps for any other client reservations you want to add, and then click Close.

Notes

  • XOX
  • When adding a reservation, the DHCP server checks for the address you enter in the database to make sure it is not currently in use by another client.
  • Reservations are applied on the basis of the DHCP client media access control (MAC) address for the applicable network connection. To locate this address, at the client computer, type ipconfig /all at a command prompt, and view the Physical Address for the connection. Alternately, you can right-click the connection in the Network Connections folder, and select Properties to view this information.

Related Topics


Change information for a reserved client

Microsoft Windows Graphic

To change information for a reserved client

  1. Open DHCP.
  2. In the console tree, click Reservations.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Reservations
  3. In the details pane, click the reserved client for which you want to change information.
  4. On the Action menu, click Properties.
  5. Modify the reservation properties you want to change, and then click OK.

Notes

  • XOX
  • Reservation IP addresses cannot be modified. If you want to change the IP address of a reservation, delete the reservation, and then recreate it with the new IP address.

Related Topics


Assign an option to a reserved client

Microsoft Windows Graphic

To assign an option to a reserved client

  1. Open DHCP.
  2. In the console tree, click Reservations.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Reservations
  3. In the details pane, click the reserved client for which you want to assign options.
  4. On the Action menu, click Configure Options.
  5. In the list of Available Options, select the check box for the first option you want to configure.
  6. Under Data entry, type the information required for this option.
  7. Repeat the two previous steps for any other reservation options you want to specify, and then click OK.

Notes

  • XOX
  • Reservation options configured here override option values assigned at either the server or scope levels of configuration.
  • Locally defined options configured manually at the client override reservation options.

Related Topics


Configure advanced (class-based) options for a reserved client

Microsoft Windows Graphic

To configure advanced (class-based) options for a reserved client

  1. Open DHCP.
  2. In the console tree, click Reservations.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Reservations
  3. In the details pane, click the reserved client for which you want to assign options.
  4. On the Action menu, click Configure Options.
  5. Click the Advanced tab.
  6. Select from the following:
    • For Vendor class, scroll to select the defined vendor class at the DHCP server (or use the default, DHCP Standard Options) for assigning options to the reserved client.
    • For User class, scroll to select the defined user class at the DHCP server (or use the default, Default User Class) for assigning options to the reserved client.
  7. In the list of Available Options, select the check box for the first option you want to configure.
  8. Under Data entry, type the information required for this option.
  9. Repeat the two previous steps for any other options you want to specify, and then click OK.

Notes

  • XOX
  • If a class-based option is assigned, it only applies if the reserved client is identified as a member of the specified user or vendor classes.

Related Topics


Change the reserved IP address for a client

Microsoft Windows Graphic

To change the reserved IP address for a client

  1. Open DHCP.
  2. In the console tree, click Reservations.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
    • Reservations
  3. In the details pane, select the reserved client for which you want to change the IP address.
  4. To delete the current reservation, on the Action menu, click Delete.
  5. Add a new reservation in DHCP that uses the new IP address for the client.

    For more information, see Related Topics.

Notes

  • XOX
  • The IP address in an existing client reservation cannot be modified directly. To achieve similar results, the existing reservation must be deleted and a new reservation added.

Related Topics


Manage databases

  • Back up the DHCP database
  • Move a DHCP database to another server
  • Restore the DHCP database
  • Set the DHCP database backup path
  • Set the DHCP database path


Back up the DHCP database

Microsoft Windows Graphic

To back up the DHCP database

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Backup.
  4. In the Browse For Folder dialog box, select the folder where you want to store the backup DHCP database, and then click OK.

Notes

  • To perform this procedure you must be a member of the Administrators group or the DHCP Administrators group on the DHCP server.
  • XOX
  • You must choose a local drive for the DHCP database backup folder.
  • The DHCP service creates an automatic backup of the DHCP database during normal operation. The default storage location for this copy of the database backup is systemroot\System32\Dhcp\Backup.
  • It is recommended that you back up your DHCP database to a location other than the local drive using Windows Backup (ntbackup.exe) or non-Microsoft backup software. For more information, see Related Topics.
  • When you store a manually created backup of the DHCP database in the same location as the synchronous backup that the DHCP server creates every 60 minutes, the manual backup is overwritten when automatic backup occurs.

Related Topics


Move a DHCP database to another server

Microsoft Windows Graphic

To move a DHCP database to another server

This topic provides details on how to move a DHCP database from one server computer (the source server) to another server computer (the destination server).

To back up the DHCP database (at the source server)

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Backup.
  4. In the Browse For Folder dialog box, select the folder that will contain the backup DHCP database, and then click OK.
  5. Stop the DHCP server.

    This prevents the server from assigning new address leases to clients after the database has been backed up.

    For more information, see To start or stop a DHCP server.

  6. Disable the DHCP Server service in the list of services.

    This prevents the DHCP server from starting after the database has been transferred. For more information, see To enable or disable a service for a hardware profile.

  7. Copy the folder that contains the backup DHCP database to the destination DHCP server computer.

Notes

  • XOX
  • You must choose a local drive for the DHCP database backup folder.
  • When you stop the DHCP service, DHCP clients cannot obtain address leases or renewals from the server.
  • The DHCP service creates an automatic backup of the DHCP database during normal operation. The default storage location for this copy of the database backup is systemroot\System32\Dhcp\Backup.

To restore the DHCP database (at the destination server)

  1. If you have not already installed the DHCP server software, install it.

    For more information, see To install a DHCP server.

  2. Open DHCP.
  3. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  4. On the Action menu, click Restore.
  5. In the Browse For Folder dialog box, select the folder that contains the backup DHCP database, and then click OK.

Notes

  • To perform this procedure you must be a member of the Administrators group or the DHCP Administrators group on the source and destination DHCP servers.
  • XOX
  • Only DHCP databases from the same language version can be restored. For example, a DHCP database from DHCP server running an English language version of the operating system cannot be restored to a DHCP server running a Japanese language version of the operating system.
  • To restore the DHCP database, the DHCP service is temporarily stopped. When it is stopped, DHCP clients are unable to contact the DHCP server and obtain IP addresses.


Restore the DHCP database

Microsoft Windows Graphic

To restore the DHCP database

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Restore.
  4. In the Browse For Folder dialog box, select the folder that contains the backup DHCP database, and then click OK.

Notes

  • To perform this procedure you must be a member of the Administrators group or the DHCP Administrators group on the DHCP server.
  • XOX
  • Only DHCP databases from the same language version can be restored. For example, a DHCP database from DHCP server running an English language version of the operating system cannot be restored to a DHCP server running a Japanese language version of the operating system.
  • To restore the DHCP database, the DHCP service is temporarily stopped. When it is stopped, DHCP clients are unable to contact the DHCP server and obtain IP addresses.
  • For more information, see Related Topics.

Related Topics


Set the DHCP database backup path

Microsoft Windows Graphic

To set the DHCP database backup path

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. In the Server Properties dialog box, click the Advanced tab, click Backup path, and delete the default backup path (C:\WINDOWS\System32\dhcp\backup).
  5. Type the backup path you prefer, or click Browse to select a folder location.

Notes

  • XOX
  • This procedure describes how to specify the path DHCP uses when backing up the database. It does not set the path used by DHCP to store the primary database on the applicable server.
  • By default, the DHCP database is automatically backed up every hour. However, when you change the backup folder location, an automatic backup of the database does not occur. You can back up the database immediately after changing the backup folder location by using Backup on the DHCP console Action menu. Automatic backups will then occur every hour.
  • For more information, see Related Topics.

Related Topics


Set the DHCP database path

Microsoft Windows Graphic

To set the DHCP database path

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. In Server Properties, click the Advanced tab, select Database path, and then delete the default database path (C:\WINDOWS\System32\Dhcp).
  5. Type the path you prefer, or click Browse to select a folder location.

Notes

  • XOX
  • This procedure describes how to specify the path DHCP uses when storing the database on the applicable DHCP server. It does not set the path used by DHCP when you back up a database with the Backup command.

Related Topics


Manage BOOTP and remote access clients

  • View the BOOTP table
  • Add an entry to the BOOTP table
  • Add dynamic BOOTP client support to a scope
  • Change the lease time for remote access clients


View the BOOTP table

Microsoft Windows Graphic

To view the BOOTP table

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click Properties.
  4. Verify that the Show the BOOTP table folder check box is selected.

    If the check box is cleared, select it and then click OK.

  5. In the console tree, click BOOTP Table.

    Where?

    • DHCP
    • applicable DHCP server
    • BOOTP Table

    BOOTP entries, if any have been added to the BOOTP table, appear in the details pane.

Notes

  • XOX
  • By default, the BOOTP table is empty. For more information, see Related Topics.

Related Topics


Add an entry to the BOOTP table

Microsoft Windows Graphic

To add an entry to the BOOTP table

  1. Open DHCP.
  2. In the console tree, click BOOTP Table.

    Where?

    • DHCP
    • applicable DHCP server
    • BOOTP Table

    If the BOOTP table does not appear, see Related Topics.

  3. On the Action menu, click New Boot Image.
  4. In the Add BOOTP Entry dialog box, enter the required information.

    To view a description of a dialog box item, right-click the item, and then click What's This?.

  5. Click Add.
  6. Repeat the previous two steps for each additional BOOTP entry you want to add, and then click Close.

Note

  • XOX

Related Topics


Add dynamic BOOTP client support to a scope

Microsoft Windows Graphic

To add dynamic BOOTP client support to a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable superscope (if used)
    • applicable scope
  3. On the Action menu, click Properties.
  4. Click the Advanced tab.
  5. For Assign IP addresses dynamically to clients of, click either Both or BOOTP only.
  6. If needed, in Lease duration for BOOTP clients adjust the default lease length.

    The lease length is used by the DHCP server to determine how long to preserve leases made dynamically for BOOTP clients of the applicable scope.

Notes

  • XOX
  • Unlike DHCP, where clients can initiate a protocol message to release or renew their address lease, BOOTP clients can only obtain or negotiate their IP address lease at boot time. For this reason, it is recommended that you select a lease length for BOOTP clients that exceeds the time between when BOOTP clients are restarted on the network.

Related Topics


Change the lease time for remote access clients

Microsoft Windows Graphic

To change the lease time for remote access clients

  1. Open DHCP.
  2. In the console tree, click Scope Options.

    Where?

    • DHCP
    • applicable DHCP server
    • applicable scope
  3. Right-click Scope Options and click Configure Options.
  4. Click Advanced.
  5. In User class, select Default Routing and Remote Access Class.
  6. In Available Options, click the check box for 051 Lease.
  7. In Long, type the lease value in seconds.

    For example, if you want the lease time to be one hour, type: 3600

Note

  • XOX

Related Topics


Use DHCP command-line tools

  • Use DHCP commands interactively at the command prompt
  • Use DHCP commands non-interactively or in scripts


Use DHCP commands interactively at the command prompt

Microsoft Windows Graphic

To use DHCP commands interactively at the command prompt

  1. Open Command Prompt.
  2. Type netsh.
  3. At the netsh> command prompt, type dhcp.
  4. At the dhcp> command prompt, type:

    server \\ServerName

    Or, type:

    server IPAddress

    Where ServerName and IPAddress are the server that you want to manage.

  5. Once connected, you can use any supported Netsh DHCP context command. Type /? or help to display the immediate context command menu, or type list to list all of the Netsh DHCP context commands available for use.

Notes

  • You must be a member of the Administrators group or the DHCP Administrators group to administer DHCP servers using the DHCP console or the Netsh commands for DHCP. You should restrict the membership of these groups to the minimum number of users necessary to administer the server. In addition, only members of the Domain Admins group can authorize or unauthorize a DHCP server in Active Directory. If there are users who need read-only access to the DHCP console, add them to the DHCP Users group instead of the DHCP Administrators group. For more information about using Netsh commands for DHCP, see Related Topics.
  • XOX
  • The \\ServerName parameter is optional and can be left unspecified if you are performing commands locally at the DHCP server. If the server being managed is remote, this parameter is required, and the name of the server must be specified.

Related Topics


Use DHCP commands non-interactively or in scripts

Microsoft Windows Graphic

To use DHCP commands non-interactively or in scripts

  1. Open Command Prompt.
  2. At the command prompt or in scripted usage, you can use Netsh commands for DHCP non-interactively by using the following fully qualified command syntax:

    netsh dhcp server [\\ServerName] SubCommand

Notes

  • You must be a member of the Administrators group or the DHCP Administrators group to administer DHCP servers using the DHCP console or the Netsh commands for DHCP. You should restrict the membership of these groups to the minimum number of users necessary to administer the server. In addition, only members of the Domain Admins group can authorize or unauthorize a DHCP server in Active Directory. If there are users who need read-only access to the DHCP console, add them to the DHCP Users group instead of the DHCP Administrators group. For more information about using Netsh commands for DHCP, see Related Topics.
  • XOX
  • The \\ServerName parameter is optional and can be left unspecified if you are performing commands locally at the DHCP server. If the server being managed is remote, this parameter is required, and the name of the server must be specified.

Related Topics


Concepts

This section provides general background information about Dynamic Host Configuration Protocol (DHCP) and server and client software provided by Microsoft and the Windows Server 2003 family.

  • DHCP overview
  • Understanding DHCP
  • Administering DHCP
  • Resources


DHCP overview

This section covers:

  • Security information for DHCP
  • DHCP defined
  • Benefits of using DHCP
  • How DHCP works
  • DHCP terminology
  • DHCP tools
  • Multicast address allocation
  • New features for DHCP
  • Planning DHCP networks


Security information for DHCP

It is important to follow best practices for security when using DHCP servers on your network. For more information, see Best practices for security.

The following are known security issues for DHCP and related protocols:

  • DHCP is an unauthenticated protocol.

    When a user connects to the network, the user is not required to provide credentials in order to obtain a lease. An unauthenticated user can, therefore, obtain a lease for any DHCP client whenever a DHCP server is available to provide a lease. Any option values that the DHCP server provides with the lease, such as WINS server or DNS server IP addresses, are available to the unauthenticated user. If the DHCP client is identified as a member of a user class or vendor class, the options that are associated with the class are also available.

    Malicious users with physical access to the DHCP-enabled network can instigate a denial-of-service attack on DHCP servers by requesting many leases from the server, thereby depleting the number of leases that are available to other DHCP clients.

    • Recommendations:

    • Ensure that unauthorized persons do not have physical or wireless access to your network.
    • Enable audit logging for every DHCP server on your network. Regularly check audit log files, and monitor them when the DHCP server receives an unusually high number of lease requests from clients. Audit log files provide the information that you need to track the source of any attacks made against the DHCP server. The default location of audit log files is %windir%\System32\Dhcp. For more information, see To enable DHCP server logging, Audit logging, and Analyzing server log files. You can also check the system event log for explanatory information about the DHCP Server service. For more information, see Event Viewer overview.

      • Note

      • When clients running XOX use 802.1X-enabled local area network (LAN) switches or wireless access points to access the network , authentication occurs before the DHCP server assigns a lease, thereby providing greater security for DHCP.
  • Denial-of-service attacks against the DNS server can be made through the DHCP server.

    When the DHCP server is configured to act as a DNS proxy server for DHCP clients and to perform DNS dynamic updates, it is possible for a malicious user to perform a denial-of-service attack against both the DHCP server and the DNS server by flooding the DHCP server with requests for leases.

    Recommendations:

    • Ensure that unauthorized persons do not have physical or wireless access to your network.
    • Use the DHCP audit logs, located by default at %windir%\System32\Dhcp, to monitor DNS dynamic updates by the DHCP server. The following event IDs are used for DNS dynamic update events:

      Event ID | DHCP Event
      30 | DNS dynamic update request to the DNS server
      31 | DNS dynamic update failed
      32 | DNS dynamic update successful

      The IP address of the DHCP client is included in the DHCP audit log, providing the ability to track the source of the denial-of-service attack. For more information, see Analyzing server log files and Audit logging.

  • Unauthorized, non-Microsoft DHCP servers can lease IP addresses to DHCP clients.

    Only DHCP servers running Windows 2000 or Windows Server 2003 can be authorized in Active Directory®. If a DHCP server running Windows 2000 or Windows Server 2003 discovers it is not authorized in Active Directory, the DHCP server stops servicing DHCP clients. Because of this authorization feature, if a malicious or incompetent user installs an unauthorized DHCP server running Windows 2000 or Windows Server 2003 on the organization network, the server cannot assign incorrect or conflicting leases, configure DHCP clients with inaccurate options, or disrupt network services.

    Non-Microsoft DHCP server software does not include the authorization feature that is included in Windows 2000 and Windows Server 2003 DHCP. Because DHCP clients broadcast DHCP discover messages to the nearest DHCP server, if a malicious user installs a non-Microsoft DHCP server on the organization network, nearby DHCP clients will receive incorrect leases that might conflict with the IP addresses assigned to other DHCP clients on the network. In addition, DHCP clients that obtain a lease from the non-Microsoft DHCP server can be configured by the server with option information that is inaccurate. This might reroute network traffic, causing the network to function improperly.

    Recommendation:

    • Ensure that unauthorized persons do not have physical or wireless access to your network.

Additional recommendations

Before you install and configure DHCP for your network, consider:

  • Restricting who can administer the DHCP service.

    You must be a member of the Administrators group or the DHCP Administrators group to administer DHCP servers using the DHCP console or the Netsh commands for DHCP. In addition, only members of the Domain Admins group can authorize or unauthorize a DHCP server in Active Directory. Restrict the membership of these groups to the minimum number of users necessary to administer the server.

    If there are users who need read-only access to the DHCP console, add them to the DHCP Users group instead of to the DHCP Administrators group. For more information, see DHCP groups.


DHCP defined

Dynamic Host Configuration Protocol (DHCP) is an IP standard for simplifying management of host IP configuration. The DHCP standard provides for the use of DHCP servers as a way to manage dynamic allocation of IP addresses and other related configuration details for DHCP-enabled clients on your network.

Every computer on a TCP/IP network must have a unique IP address. The IP address (together with its related subnet mask) identifies both the host computer and the subnet to which it is attached. When you move a computer to a different subnet, the IP address must be changed. DHCP allows you to dynamically assign an IP address to a client from a DHCP server IP address database on your local network:

Simple DHCP network

For TCP/IP-based networks, DHCP reduces the complexity and amount of administrative work involved in reconfiguring computers.

The Microsoft® Windows® Server 2003 family provides an RFC-compliant DHCP service you can use to manage IP client configuration and automate IP address assignment on your network.


Benefits of using DHCP

DHCP provides the following benefits for administering your TCP/IP-based network:

  • Safe and reliable configuration

    DHCP avoids configuration errors caused by the need to manually type in values at each computer. Also, DHCP helps prevent address conflicts caused by a previously assigned IP address being reused to configure a new computer on the network.

  • Reduces configuration management

    Using DHCP servers can greatly decrease time spent configuring and reconfiguring computers on your network. Servers can be configured to supply a full range of additional configuration values when assigning address leases. These values are assigned using DHCP options.

    Also, the DHCP lease renewal process helps assure that where client configurations need to be updated often (such as users with mobile or portable computers who change locations frequently), these changes can be made efficiently and automatically by clients communicating directly with DHCP servers.


How DHCP works

DHCP uses a client-server model. The network administrator establishes one or more DHCP servers that maintain TCP/IP configuration information and provide it to clients. The server database includes the following:

  • Valid configuration parameters for all clients on the network.
  • Valid IP addresses maintained in a pool for assignment to clients, plus reserved addresses for manual assignment.
  • Duration of a lease offered by the server. The lease defines the length of time for which the assigned IP address can be used.

With a DHCP server installed and configured on your network, DHCP-enabled clients can obtain their IP address and related configuration parameters dynamically each time they start and join your network. DHCP servers provide this configuration in the form of an address-lease offer to requesting clients.


DHCP terminology

Term | Description
scope | A scope is the full consecutive range of possible IP addresses for a network. Scopes typically define a single physical subnet on your network to which DHCP services are offered. Scopes also provide the primary way for the server to manage distribution and assignment of IP addresses and any related configuration parameters to clients on the network.
superscope | A superscope is an administrative grouping of scopes that can be used to support multiple logical IP subnets on the same physical subnet. Superscopes only contain a list of member scopes or child scopes that can be activated together. Superscopes are not used to configure other details about scope usage. For configuring most properties used within a superscope, you need to configure member scope properties individually.
exclusion range | An exclusion range is a limited sequence of IP addresses within a scope, excluded from DHCP service offerings. Exclusion ranges assure that any addresses in these ranges are not offered by the server to DHCP clients on your network.
address pool | After you define a DHCP scope and apply exclusion ranges, the remaining addresses form the available address pool within the scope. Pooled addresses are eligible for dynamic assignment by the server to DHCP clients on your network.
lease | A lease is a length of time that a DHCP server specifies, during which a client computer can use an assigned IP address. When a lease is made to a client, the lease is active. Before the lease expires, the client typically needs to renew its address lease assignment with the server. A lease becomes inactive when it expires or is deleted at the server. The duration for a lease determines when it will expire and how often the client needs to renew it with the server.
reservation | You use a reservation to create a permanent address lease assignment by the DHCP server. Reservations assure that a specified hardware device on the subnet can always use the same IP address.
option types | Option types are other client configuration parameters a DHCP server can assign when serving leases to DHCP clients. For example, some commonly used options include IP addresses for default gateways (routers), WINS servers, and DNS servers. Typically, these option types are enabled and configured for each scope. The DHCP console also permits you to configure default option types that are used by all scopes added and configured at the server. Most options are predefined through RFC 2132, but you can use the DHCP console to define and add custom option types if needed.
options class | An options class is a way for the server to further manage option types provided to clients. When an options class is added to the server, clients of that class can be provided class-specific option types for their configuration. For Microsoft® Windows® 2000 and XOX, client computers can also specify a class ID when communicating with the server. For earlier DHCP clients that do not support the class ID process, the server can be configured with default classes to use instead when placing clients in a class. Options classes can be of two types: vendor classes and user classes.


DHCP tools

The primary tools that you use to manage DHCP servers are the DHCP console and the Netsh commands for DHCP.

The Netsh commands for DHCP

You can type the Netsh commands for DHCP in a command prompt window at the netsh dhcp> command prompt, or you can execute the Netsh commands for DHCP in batch files and other scripts. All of the functionality that is available in the DHCP console is available at the netsh dhcp> command prompt.

For more information about Netsh commands for DHCP (including syntax, parameters, and examples), see Netsh commands for DHCP. For an example of how to use Netsh commands for DHCP in batch files and scripts, see Netsh DHCP example.

The DHCP console

The DHCP console is added to the Administrative Tools folder in Control Panel when you install a DHCP server running Windows Server 2003. The DHCP console appears as a Microsoft Management Console (MMC) snap-in, to further integrate DHCP administration into your total network management.

After you install a DHCP server, you can use the DHCP console or the Netsh commands for DHCP to perform these basic administrative server tasks:

  1. Create scopes.
  2. Add and configure superscopes and multicast scopes.
  3. View and modify scope properties for scopes, such as setting additional exclusion ranges.
  4. Activate scopes, multicast scopes, or superscopes.
  5. Monitor scope leasing activity by reviewing the active leases for each scope.
  6. Create reservations in scopes as needed for DHCP clients that require a permanent IP address for leased use.

In addition, you can also use the DHCP console or the Netsh commands for DHCP to perform the following optional or advanced setup tasks:

  • Add new custom default option types.
  • Add and configure any user or vendor-defined option classes.
  • Further configure other server properties, such as audit logging or BOOTP tables.

The DHCP console also contains enhancements that were suggested by network managers. These include enhanced server performance monitoring, more predefined DHCP option types, dynamic update support for clients running earlier versions of Windows, and detection of unauthorized DHCP servers on your network.

Notes

  • The Microsoft® Windows® Server 2003 family includes new features beyond those provided in earlier versions. For more information, see New features for DHCP.
  • The DHCP console provides new ways to perform familiar DHCP administrative tasks previously performed in Windows NT® 4.0 using DHCP Manager. For more information, see New ways to do familiar tasks.
  • For a simple list of Netsh commands for DHCP (not including syntax, parameters, and examples), see Managing DHCP from the command line. To learn more about using the Netsh command-line tool, see Use DHCP command-line tools.
  • DHCP servers running Windows 2000 cannot be authorized in Active Directory® using the Windows Server 2003 administrative tools (the DHCP console and the Netsh commands for DHCP) unless Windows 2000 Server Service Pack 2 is installed.


Multicast address allocation

DHCP servers running Microsoft® Windows® Server 2003 allow the assignment of multicast addresses, in addition to the assignment of unicast addresses.

A proposed Internet Engineering Task Force (IETF) standard defines a client/server protocol, the Multicast Address Dynamic Client Allocation Protocol (MADCAP), for defining multicast address allocation between supporting servers and clients. The primary benefit of the proposed MADCAP standard is that you can use it to leverage your existing network infrastructure for assigning multicast addresses in the same way as other IP addresses are currently assigned using DHCP.

Typical applications for multicast are conferencing and audio, which usually require users to specially configure multicast addresses. Unlike IP broadcasts, which are received by all computers or other hosts on the network, a multicast address is a group of computers, using the concept of a group membership to identify the computers to which the message is to be sent.

The multicast address allocation feature has two parts:

  1. A MADCAP server, which distributes multicast addresses.

    To use this feature, the administrator first configures multicast scopes and the corresponding multicast IP ranges on the server, through the DHCP console. Once these scopes are configured and activated, the DHCP Server service can provide multicast addresses in the same way it normally provides unicast IP addresses where DHCP scopes are used.

  2. Client-side application programming interfaces (APIs), which MADCAP clients can use to request, renew, or release multicast addresses.

    Applications that implement MADCAP client support can call these APIs to request a multicast address from a given multicast scope at the MADCAP server. The underlying MADCAP implementation uses protocol messages similar to the DHCP messaging format to negotiate the multicast address lease between the client and server.

For more information, see Using multicast scopes.

Notes

  • The standards for multicast address allocation are managed by the Multicast address-allocation (MALLOC) working group of the IETF.
  • You can obtain RFCs from the Request for Comments Web site.

    This Web site is currently maintained by members of the Information Sciences Institute (ISI), who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standard, proposed Internet standard (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.

  • XOX


New features for DHCP

Microsoft® Windows® Server 2003 Dynamic Host Configuration Protocol (DHCP) provides the following new features:

  • DHCP client alternate configuration

    With DHCP client alternate configuration, you can easily move a computer between two or more networks, one configured with static IP addresses and one or more configured with DHCP, without needing to reconfigure network adapter parameters, such as IP address, subnet mask, default gateway, preferred and alternate Domain Name Service (DNS) servers, and Windows Internet Name Service (WINS) servers. For more information, see DHCP client alternate configuration and To use DHCP client alternate configuration.

  • DHCP database backup and restore

    You can back up and restore the DHCP database using the Backup and Restore commands in the DHCP console. For more information about the Backup command, see Backing up the DHCP database and To back up the DHCP database. For more information about the Restore command, see Restoring server data and To restore the DHCP database.

The following features were new for Windows 2000 Server and are also provided with the Windows Server 2003 family:

  • Local groups for providing limited server and console access to DHCP administrators and users

    Two local administrative groups are created when a DHCP server is installed on a server computer: the DHCP Users and DHCP Administrators groups. The DHCP Users group can be used to provide read-only console access to the server. Where used, this group grants members the ability to view, but not modify, server data.

    The DHCP Administrators group provides a higher level of administrative access. Members added to this group can fully manage and modify any data at the DHCP server, but are not provided full unlimited administrative access, such as if the local Administrators group were used instead to provide administrative access to the applicable DHCP server. For more information, see DHCP groups.

  • Automatic assignment of IP addresses

    For Windows 98, Windows 2000, XOX, and the Windows Server 2003 family, DHCP-enabled clients are automatically assigned a temporary IP configuration if a DHCP server is unavailable to provide a lease when the client starts on a network. For DHCP clients running these versions of Windows, the client tries to contact a DHCP server in the background every five minutes to eventually obtain its valid IP address lease.

    Automatic assignment is always transparent to users, who are not prompted if the client fails to obtain a lease from a DHCP server. Addresses are self-assigned from a network address range that is reserved for private TCP/IP usage and not used on the Internet.

  • Enhanced performance monitoring and server reporting capabilities

    DHCP is critical to the success of your network infrastructure. Without working DHCP servers, IP clients can lose some or all of their ability to access or use your network. Because many experienced network administrators realize the importance of closely monitoring DHCP servers, several changes have been made to assist in this area.

    Performance monitoring counters are available on computers running Windows 2000 or Windows Server 2003 operating systems to help you monitor DHCP server performance on your network. For more information, see Monitoring DHCP server performance.

  • Expanded scope support for multicast scopes and superscopes

    Microsoft DHCP server supports additional scopes that you can use to streamline your ongoing administration of IP address configurations.

    New multicast scopes make it possible for DHCP-enabled clients to lease Class D-type IP addresses (224.0.0.0 to 239.255.255.255) for participation in multicast groups. For more information, see Using multicast scopes.

    Superscopes (a late addition to Windows NT® Server 4.0) are useful for creating an administrative grouping of member scopes. Superscopes can be helpful when you want to renumber or expand the IP address space on your network without disturbing currently active scopes. For more information, see Using superscopes.

  • Support for user-specified and vendor-specified option classes

    • You can use this feature to separate and distribute appropriate options for clients with similar or special configuration needs.

    For example, you might assign all DHCP-enabled clients on the same floor of your building to the same option class. You could use this class (configured with the same DHCP Class ID value) to distribute other options data during the lease process, overriding any scope or global default options. In this way, options appropriate to a set of class-member clients in the same network location (such as a specific default gateway or parent domain name) are applied as class-specific options. For more information, see Using option classes.

  • Integration of DHCP with DNS

    A DHCP server running Windows 2000 or Windows Server 2003 can enable dynamic updates in the DNS namespace for any of its clients that support these updates. Scope clients can then use DNS dynamic update protocol to update their host name-to-address mapping information (which is stored in zones on the DNS server) whenever changes occur to their DHCP-assigned address. For more information, see Using DNS servers with DHCP.

  • Detection of unauthorized DHCP servers through the use of Active Directory® integration

    When a DHCP server is unintentionally started on a network, it can cause a variety of network problems. To prevent this scenario from occurring, Windows 2000 Server and the Windows Server 2003 family provide a method for authorizing a DHCP server as well as a means to detect and shut down unauthorized servers.

    When a domain member DHCP server running Windows 2000 or Windows Server 2003 attempts to start on the network, Active Directory is queried, and the IP address of the server is compared to the list of authorized DHCP servers. If a match is found, the server computer is authorized as a DHCP server. If a match is not found, the following occurs:

    • The server is not authorized in Active Directory.
    • The server is identified as an unauthorized server.
    • The server stops leasing IP addresses to DHCP clients.

    In order to use DHCP server authorization, you must deploy Active Directory and the DHCP service on a server running Windows 2000 or Windows Server 2003. Other DHCP servers do not support this feature.

    For more information, see Authorizing DHCP servers.

  • Dynamic support for BOOTP clients.

    The DHCP service provides additional support for BOOTP clients in large enterprise networks through the addition of dynamic BOOTP.

    Dynamic BOOTP is an extension of the BOOTP protocol that permits the DHCP server to configure BOOTP clients without having to use explicit fixed address configuration. This feature provides easier administration of large BOOTP networks by allowing automatic distribution of IP addresses (much the same way that DHCP does) without having to change client side behavior.


Planning DHCP networks

This topic covers the following DHCP network planning issues.

  • How to determine the number of DHCP servers to use
  • How to support DHCP clients on additional subnets
  • Planning for routed DHCP networks
  • Other planning considerations for enterprise networks

How to determine the number of DHCP servers to use

Because there is no fixed limit to the maximum number of clients a DHCP server can service or to the number of scopes you can create on a DHCP server, the primary factors to consider when you determine the number of DHCP servers to use are network architecture and server hardware. For example, in a single subnet environment, only one DHCP server is necessary, although you may want to use two servers or deploy a DHCP server cluster for increased fault tolerance. In multiple subnet environments, routers must forward DHCP messages between subnets, so router performance can affect your DHCP service. In both cases, DHCP server hardware affects service to clients.

For more information on deploying a DHCP server cluster, see Cluster support for DHCP servers. For more information on using two DHCP servers for increased fault tolerance, see Using the 80/20 rule for scopes.

When you determine the number of DHCP servers to use, consider the following:

  • The location of routers on the network and whether you want a DHCP server on each subnet.

    • When you extend the use of a DHCP server across more than one network, you often need to configure additional DHCP relay agents and, in some cases, use superscopes as well.

  • The transmission speed between the segments for which DHCP service is provided.

    • If you have slower WAN links or dial-up links, you may need a DHCP server on both sides of these links to service clients locally.

  • The speed of the server disk drives and the amount of random access memory (RAM) installed in the DHCP server computer.

    • In order to maximize DHCP server performance, use the fastest disk drives and the most RAM possible. Carefully evaluate disk access time and average times for disk read and write operations when you plan for your DHCP server hardware needs.

  • Practical constraints based on the IP address class selected for use and other server configuration details.

You can test your DHCP servers before deployment on the organization network in order to determine the limitations and abilities of your hardware and to see whether network architecture, traffic, and other factors affect DHCP server performance. Hardware and configuration tests also allow you to determine the number of scopes to configure at each server.

To provide a general idea of DHCP server performance, a DHCP server running Microsoft® Windows® Server 2003 was run in a test lab environment, and a custom stress application was used against the server. The details of this lab test can help you configure your tests and determine how many DHCP servers to use on your network:

Server and network configuration

  • Processors: Two x86 Family 6 Model 7 Stepping 3 GenuineIntel ~498 megahertz (MHz)
  • Total physical memory: 256.00 megabytes (MBs)
  • Network adapters: Three Ethernet 802.3 100 megabits per second (mbps)
  • Subnets serviced: Six, four of which are separated from the test server by routers running the DHCP Relay Agent service.
  • Operating system: XOX
  • Number of scopes: 5,155
  • DHCP database size at maximum load: 2 gigabytes (GBs)
  • Additional factors: Several thousand exclusion ranges, option values, and reservations are configured in the scopes on the server.

Test details

The DHCP server was hit with both valid and invalid DHCP client lease and renewal requests from a client/attack simulation stress application on six subnets for 1,152 hours (48 days).

Test results

The DHCP server provided clients with the following service during the test:

DHCP server function | Message and lease volume handled (1,152 hours)
Lease assignments | 68,412,059
DHCP discover messages | 20,039,592
DHCP offer messages | 20,039,253
DHCP request messages | 57,559,426
DHCP acknowledgement messages | 57,470,934
DHCP negative acknowledgement messages sent by the server | 484,012
DHCP decline messages | 190,901
Lease releases | 0

Notes

  • These test results are intended to provide a general idea of DHCP server performance capacity. Tests were performed on average hardware and do not imply any limitation of the DHCP service. In addition, the large size of the test DHCP server database (2 GBs) is extremely unusual and was produced due to the high volume of DHCP traffic that the test application generated. In real world environments, typical database sizes are in the tens of MBs or less.
  • When you add a large number of scopes to the server, be aware that each scope creates a corresponding need for additional, incremental increases to the amount of disk space used for the DHCP server registry and for the server paging file. For more information, see To change the size of the virtual memory paging file.
  • DHCP servers running Windows Server 2003 provide performance monitoring tools that you can use to test and monitor your servers. For more information, see Monitoring DHCP server performance.

A DHCP planning alternative: configuring standby servers

Most networks need one primary online DHCP server and one other DHCP server acting as a secondary or backup server. If you choose not to implement two DHCP servers using the 80/20 rule for balancing scopes but want to continue to provide a measure of potential fault tolerance, you might consider implementing a backup or hot standby DHCP server as an alternative.

In the hot standby configuration, the standby DHCP server is another server computer that is installed and configured identically to your primary DHCP server. In the case of the standby, the only difference is that the standby server and its scopes are not activated for use under normal conditions. Duplicate scopes are configured but not activated except when critically needed, such as to substitute for the primary DHCP server because it has stopped or been taken offline for an extended period of time.

Because the hot standby solution requires special attention to its configuration and also manual administration for ensuring fall-over transition for DHCP clients to use it, it is less recommended as a planning alternative than the use of two to three DHCP servers that balance active scope use.

Supporting additional subnets

For DHCP service to support additional subnets on your network, you must first determine whether the routers used to connect adjoining subnets can support relaying of BOOTP and DHCP messages. If routers cannot be used for DHCP and BOOTP relay, you can set up either of the following for each subnet:

  • A computer running Windows NT® Server 4.0, Windows 2000 Server, or a Windows Server 2003 operating system configured to use the DHCP Relay Agent component.

    This computer simply forwards messages back and forth between clients on the local subnet and a remote DHCP server, using the IP address of the remote server. The DHCP Relay Agent service is available only on computers running Windows NT Server 4.0, Windows 2000 Server, or Windows Server 2003 operating systems.

  • A computer running a Windows Server 2003 operating system configured as a DHCP server for the local subnet.

    This server computer must contain and manage scope and other address-configurable information for the local subnet it serves.

For more information, see Relay agent configurations.

Planning for routed DHCP networks

In routed networks that use subnets to divide network segments, planning options for DHCP services must observe some specific requirements for a full implementation of DHCP services to function. These requirements include:

  • One DHCP server must be located on at least one subnet in the routed network.
  • For a DHCP server to support clients on other remote subnets separated by routers, a router or remote computer must be used as a DHCP and BOOTP relay agent to support forwarding of DHCP traffic between subnets.

The following illustration shows a simple routed network with DHCP implemented.

Example of a routed DHCP network

Enterprise planning considerations

For an enterprise DHCP network, you should:

  • Plan the physical subnets of the network and relative placement of DHCP servers.
  • Specify the DHCP option types and their values to be predefined per scope for the DHCP clients.

    This can include planning for scopes based on the needs of particular groups of users. For example, a unit that frequently moves computers to different locations, like a marketing group that uses portable computers docked at different stations, shorter lease durations can be defined for the related scopes. This approach collects IP addresses that are changed frequently and disposed of and returns them to the pool of available addresses that can be used for new lease offerings.

  • Recognize the impact that slower links have on your WAN environment.

    Place DHCP, WINS, and DNS servers to maximize response time and minimize low-speed traffic.

As one example of planning for a large enterprise network, the segmenting of the WAN into logical subnets can match the physical structure of the internetwork. Then one IP subnet can serve as the backbone and, this backbone in relation to each physical subnet maintains a separate IP subnet address.


Understanding DHCP

This section covers:

  • DHCP servers
  • DHCP options
  • DHCP groups
  • Understanding user and vendor classes
  • BOOTP and DHCP
  • The DHCP database
  • Audit logging
  • DHCP client alternate configuration
  • DHCP/BOOTP relay agents


DHCP servers

Configuring DHCP servers for a network provides the following benefits:

  • The administrator can assign and specify global and subnet-specific TCP/IP parameters centrally for use throughout the entire network.
  • Client computers do not require manual TCP/IP configuration.
  • When a client computer moves between subnets, its old IP address is freed for reuse. The client reconfigures its TCP/IP settings automatically when the computer is restarted in its new location.
  • Most routers can forward DHCP and BOOTP configuration requests, so DHCP servers are not required on every subnet in the network.

How clients use servers

A computer running XOX becomes a DHCP client if Obtain an IP address automatically is selected in its TCP/IP properties. When a client computer is set to use DHCP, it accepts a lease offer and can receive from the server the following:

  • Temporary use of an IP address known to be valid for the network it is joining.
  • Additional TCP/IP configuration parameters for the client to use in the form of options data.

Also, if conflict detection is configured, the DHCP server attempts to ping each available address it intends to offer prior to presenting the address in a lease offer to a client. This ensures that each IP address offered to clients is not already in use by another non-DHCP computer that uses manual TCP/IP configuration.

How servers provide optional data

In addition to an IP address, DHCP servers can be configured to provide optional data to fully configure TCP/IP for clients. Some of the most common DHCP option types configured and distributed by the DHCP server during leases include:

  • Default gateways (routers), which are used to connect a network segment to other network segments.
  • Other optional configuration parameters to assign to DHCP clients, such as IP addresses for the DNS servers or WINS servers that the client can use in resolving network host names.

For more information, see DHCP options.


DHCP options

DHCP provides an internal framework for passing configuration information on to clients on your network. Configuration parameters and other control information are carried in tagged data items stored within protocol messages exchanged between the DHCP server and its clients. These data items are called options.

Most standard DHCP options are currently defined in Request for Comments (RFCs) published by the Internet Engineering Task Force (IETF). The full set of standard DHCP options are described specifically in RFC 2132, "DHCP Options and BOOTP Vendor Extensions."

All DHCP options mentioned in RFC 2132 are predefined for you to configure and use at any DHCP server running Windows Server 2003. If needed, you can also use the DHCP console to define new DHCP options at each server.

Even though most DHCP servers can assign many options, most DHCP clients are typically designed to request or support only a subset of the full RFC-specified standard options set.

  • For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

How options are applied

Options can be managed using different levels assigned for each managed DHCP server, including:

  • Server options These options are applied for all scopes defined at a DHCP server.
  • Scope options These options are applied specifically to all clients that obtain a lease within a particular scope.
  • Class options These options are applied only to clients that are identified as members of a specified user or vendor class when obtaining a lease.
  • Reservation options These options apply only for a single reserved client computer and require a reservation to be used in an active scope.

For more information, see Setting up options.


DHCP groups

When you install the DHCP Server service, two domain local groups are created: DHCP Users and DHCP Administrators.

DHCP Users

Members of the DHCP Users group have read-only DHCP console access to the server, which allows DHCP Users to view, but not to modify, server data, including DHCP server configuration, registry keys, DHCP log files, and the DHCP database. DHCP Users cannot create scopes, modify option values, create reservations or exclusion ranges, or modify the DHCP server configuration in any other way.

DHCP Administrators

Members of the DHCP Administrators group can view and modify any data at the DHCP server. DHCP Administrators can create and delete scopes, add reservations, change option values, create superscopes, or perform any other activity needed to administer the DHCP server, including export or import of the DHCP server configuration and database. DHCP Administrators perform these tasks using the Netsh commands for DHCP or the DHCP console. For more information, see DHCP tools.

Members of the DHCP Administrators group do not have unlimited administrative rights. For example, if a DHCP server is also configured as a DNS server, a member of the DHCP Administrators group can view and modify the DHCP configuration but cannot modify DNS server configuration on the same computer.

Because members of the DHCP Administrators group have rights on the local computer only, DHCP Administrators cannot authorize or unauthorize DHCP servers in Active Directory. Only members of the Domain Admins group can perform this task. If you want to authorize or unauthorize a DHCP server in a child domain, you must have enterprise administrator credentials for the parent domain. For more information about authorizing DHCP servers in Active Directory, see Authorizing DHCP servers and To authorize a DHCP server in Active Directory.

Note

  • To be logged on as an enterprise administrator, you must log on using a member account in the Enterprise Admins group. By default, this is done by logging on as local administrator at the first domain controller created in your enterprise.

Using groups to administer DHCP servers in a domain

When you add a user or group to a DHCP Users or DHCP Administrators group on a DHCP server, the rights of the DHCP group member do not apply to all of the DHCP servers in the domain. The rights apply only to the DHCP service on the local computer. In order to assign rights to a user or group that apply to all of the DHCP servers in the domain, you can add the user or group to the DHCP Administrators group on each DHCP server in the domain. This approach is practical only on a small network with one or two DHCP servers.

An alternative approach is to add the user or group to the global group called Domain Admins. Members of the Domain Admins group can administer all of the DHCP servers in the domain, however the administrative rights of Domain Admins are not limited to the DHCP service on each DHCP server. Domain Admins have complete administrative rights on all of the computers in the domain. For this reason, it is recommended that you do not add users or groups to the Domain Admins group solely because you want to assign administrative rights for the DHCP service on all of the DHCP servers in the domain.

If you have more than two DHCP servers on your network, you can use the following steps to most effectively add members to a DHCP group:

  1. In the Active Directory Users and Computers console, create a group with universal or global scope. For more information, see To create a new group.
  2. Add users or groups to the new group you created. For more information, see To add a member to a group.
  3. At each DHCP server in the domain, add the new group (that you created in the first step) to either the DHCP Users group or the DHCP Administrators group, depending on the rights and permissions that you want group members to have.

For more information about how to add members to groups and other related tasks, see Manage server access.

For more information about groups, see Group scope and Default groups.

For more information about delegating administrative credentials, see To delegate ability to authorize DHCP servers to a non-enterprise administrator.


Understanding user and vendor classes

There are significant differences in the way in which vendor and user classes are available for use by DHCP clients and servers. The following table compares and contrasts the features of these classes.

User classes | Vendor classes
Part of proposed DHCP standard drafts.

For updated information, obtain the latest draft from the Request for Comments Web site.

 Part of accepted DHCP standard drafts (RFC 2131, 2132).
Clients identify user class membership with User class information. | Clients identify vendor class membership by using the Vendor class identifier option.
User class IDs can be set and viewed at DHCP clients running Windows 2000, XOX, or Windows Server 2003 operating systems using the ipconfig command.

For more information, see:

  • To set DHCP class ID information at a client computer
  • To show DHCP class ID information at a client computer
 Vendor class IDs are configured internally by DHCP client system vendors, such as Microsoft and other vendors.

When adding a vendor class at the server, you need to specify class data at the server that matches identically the class ID used by same-vendor clients. For more information, contact the applicable vendor.
With user classes, you can take advantage of predefined classes that can be used to support specialized groups of clients, such as BOOTP or Routing and Remote Access clients. | With vendor classes, Microsoft has implemented vendor classes to the provided classification of its DHCP clients by Windows 98, Windows 2000, or Microsoft DHCP clients which share the use of the Microsoft-reserved vendor prefix ("MSFT") in any class-related data used.
User classes are typically created for administrative reasons, such as to identify all DHCP clients in a specific site or location.

For example, all computers and printers located on the same floor in an office building might be assigned or configured as part of the same user class.

 Vendor classes are typically created for the enhancement of vendor-specific DHCP functionality.

For example, Microsoft provides several additional vendor-specific options, such as the ability to disable NetBIOS over TCP/IP at DHCP clients running Windows 2000 or XOX.
User classes are most helpful to users for managing DHCP option assignments based on their needs.

If your DHCP network is large enough to benefit from user classes, you can freely customize your DHCP environments with them. In most cases, the user class provides a way to assign and override standard DHCP option values set at either the server, scope, or reserved client level.

 Vendor classes are most helpful to vendors for managing DHCP option assignments based on vendor-specific needs without disturbing other non-vendor DHCP clients.

With a vendor class, options are passed to clients using the Vendor specific information option, which encapsulates the options it sends. This helps non-vendor clients to recognize the information as vendor-specific and ignore and discard it as needed.

Notes

  • For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)
  • For more information, see Using option classes or To create a new user or vendor class.
  • XOX


BOOTP and DHCP

The bootstrap protocol (BOOTP) is a host configuration protocol developed before DHCP. DHCP improves on BOOTP and resolves specific limitations BOOTP had as a host configuration service. RFC 951 defines BOOTP.

BOOTP/DHCP similarities

Because of the relationship between BOOTP and DHCP, both protocols share some defining characteristics. The common elements include:

  • The format structure each uses to exchange messages between the server and clients

    BOOTP and DHCP use nearly identical request messages (sent by clients) and reply messages (sent by servers). Messages in either of these protocols use a single User Datagram Protocol (UDP) datagram of 576 bytes to enclose each protocol message. Message headers are the same for both BOOTP and DHCP with one exception: the final message header field used to carry optional data. For BOOTP, this optional field is called the vendor-specific area and is limited to 64 octets. For DHCP, this area is called the options field and can carry up to 312 octets of DHCP options information.

  • Use of well-known UDP ports for client/server communication

    Both BOOTP and DHCP use the same reserved protocol ports for sending and receiving messages between servers and clients. Both BOOTP and DHCP servers use UDP port 67 to listen for and receive client request messages. BOOTP and DHCP clients typically reserve UDP port 68 for accepting message replies from either a BOOTP server or DHCP server.

    Because DHCP and BOOTP messages use nearly identical format types and packet structures, and typically use the same well-known service ports, BOOTP or DHCP relay agent programs usually treat BOOTP and DHCP messages as essentially the same message type, without differentiating between them.

  • IP address distribution as an integral part of configuration service

    Although both BOOTP and DHCP allocate IP addresses to clients during startup, they use different methods of allocation. BOOTP typically provides fixed allocation of a single IP address for each client, permanently reserving this address in the BOOTP server database. DHCP typically provides dynamic, leased allocation of available IP addresses, reserving each DHCP client address temporarily in the DHCP server database.

BOOTP/DHCP differences

There are significant differences in the way in which BOOTP and DHCP perform host configuration. The following table compares and contrasts the features of the two protocols that vary.

BOOTP | DHCP
Designed prior to DHCP. | Designed after BOOTP.
Intended to configure diskless workstations with limited boot capabilities. | Intended to configure frequently relocated networked computers (such as portables) that have local hard drives and full boot capabilities.
Dynamic BOOTP has a default 30-day expiration on IP address leases. | DHCP has a default eight-day expiration on IP address leases.
Supports a limited number of client configuration parameters called vendor extensions. | Supports a larger and extensible set of client configuration parameters called options.
Describes a two-phase bootstrap configuration process, as follows:
  • Clients contact BOOTP servers to perform address determination and boot file name selection.
  • Clients contact Trivial File Transfer Protocol (TFTP) servers to perform file transfer of their boot image.
Describes a single-phase boot configuration process whereby a DHCP client negotiates with a DHCP server to determine its IP address and obtain any other initial configuration details it needs for network operation.
BOOTP clients do not rebind or renew configuration with the BOOTP server except when the system restarts. | DHCP clients do not require a system restart to rebind or renew configuration with the DHCP server. Instead, clients automatically enter a rebinding state at set timed intervals to renew their leased address allocation with the DHCP server. This process occurs in the background and is transparent to the user.


The DHCP database

There is no set limit to the number of records that a DHCP server can store. The size of the database is dependent upon the number of DHCP clients on the network. The DHCP database grows over time as a result of clients starting and stopping on the network.

The size of the DHCP database is not directly proportional to the number of active client lease entries. Over time, as some DHCP client entries become obsolete and are deleted, there remains some unused space.

To recover the unused space, the DHCP database is compacted. Starting with Windows NT Server 4.0, dynamic database compaction occurs on DHCP servers as an automatic background process during idle time or after a database update.

Note

  • When using or upgrading DHCP databases used with earlier versions of Windows NT Server, the DHCP database requires conversion. In the Windows Server 2003 family, if a previous copy of the DHCP server database is detected during an upgrade, it is automatically converted to the current database version and format. For larger databases, this process can increase the time needed to complete the installation.

DHCP database files

The DHCP server database in Windows Server 2003 family uses the Exchange Server JET storage engine. When you install the DHCP service, the files shown in the following table are automatically created in the Systemroot\System32\Dhcp directory.

DHCP service database files

File | Description
Dhcp.mdb | The DHCP server database file.
Dhcp.tmp | A temporary file used by the DHCP database as a swap file during database index maintenance operations. This file sometimes remains in the Systemroot\System32\Dhcp directory after a system failure.
J50.log and J50#####.log | A log of all database transactions. This file is used by the DHCP database to recover data when necessary.
J50.chk | A checkpoint file.

Important

  • The J50.log file, J50#####.log file, Dhcp.mdb file, and Dhcp.tmp file should not be removed or altered.

The DHCP server database is a dynamic database that is updated as DHCP clients are assigned or as they release their TCP/IP configuration parameters. Because the DHCP database is not a distributed database like the WINS server database, maintaining the DHCP server database is less complex.

The DHCP database and related registry entries are automatically backed up at a specific interval (60 minutes by installation default). You can change this installation default by changing the value of BackupInterval in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.


Audit logging

DHCP servers running Windows Server 2003 include several logging features and server parameters that provide enhanced auditing capabilities. You can specify the following features:

  • The directory path in which the DHCP server stores audit log files. DHCP audit logs are located by default at %windir%\System32\Dhcp.
  • A maximum size restriction (in megabytes) for the total amount of disk space available for all audit log files created and stored by the DHCP service.
  • An interval for disk checking that is used to determine how many times the DHCP server writes audit log events to the log file before checking for available disk space on the server.
  • A minimum size requirement (in megabytes) for server disk space that is used during disk checking to determine if sufficient space exists for the server to continue audit logging.

Notes

  • You can selectively enable or disable the audit logging feature at each DHCP server. For more information, see To enable DHCP server logging.
  • Only the directory path in which the DHCP server stores audit log files can be modified using the DHCP console. To do so, first select the applicable DHCP server in the console tree. On the Action menu, click Properties. Next, click the Advanced tab and edit Audit log file path as necessary.
  • Other audit logging parameters described above are adjusted through registry-based configuration changes. For more information about the Windows Server 2003 DHCP server registry, see "Dynamic Host Configuration Protocol" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

How audit logging works

The audit logging behavior discussed in this section applies only to Windows 2000 DHCP and Windows Server 2003 DHCP. It replaces the previous DHCP logging behavior used in earlier versions of Windows NT Server, which do not perform audit checks and use only a single log file named Dhcpsrv.log for logging service events.

The formatted structure of DHCP server logs and the level of reporting maintained for audited logging are the same as in earlier DHCP server versions provided with Windows NT Server. For more information, see Analyzing server log files.

Naming audit log files

The DHCP Server service bases the name of the audit log file on the current day of the week, as determined by checking the current date and time at the server.

For example, when the DHCP server starts, if the current date and time are:

Monday, April 7, 2003, 04:56:42 P.M.

then the server audit log file is named:

DhcpSrvLog-Mon

Starting a daily audit log

When a DHCP server starts or a new day begins (when the local time on the computer is 12:00 A.M.), the server writes a header message in the audit log file, indicating that logging has started. Then, depending on whether the audit log file is a new or existing file, the following actions occur:

  • If the file already existed without modification for more than a day, it is overwritten.
  • If the file already existed but was modified within the previous 24 hours, the file is not overwritten. Instead, new logging activity is appended to the end of the existing file.

Disk checks

After audit logging starts, the DHCP server performs disk checks at regular intervals, to ensure both the ongoing availability of server disk space and that the current audit log file does not become too large or that log-file growth is not occurring too rapidly.

The DHCP server performs a full disk check whenever either of the following conditions occurs:

  • A set number of server events are logged.
  • When the date changes on the server computer.

By default, the DHCP server performs a periodic disk space check for every 50 events it writes to the audit log. A date change can also be detected by the DHCP server when the server computer reaches 12:00 A.M. on its locally set clock.

Each time a disk check is completed, the server determines whether disk space is filled. The disk is considered full if either of the following conditions is true:

  • Disk space on the server computer is lower than the required minimum amount for DHCP audit logging.

    By default, if the amount of disk space remaining on the server disk reaches less than 20 megabytes, audit logging is halted.

  • The current audit log file is larger than one-seventh (1/7) of the maximum allotted space or size for the combined total of all audit logs currently stored on the server.

    At the time of the disk check, the DHCP server compares the exact size (in megabytes) of the current audit log file with a value obtained by dividing the current value for the maximum number of log files the server permits to be stored simultaneously before overwriting and discarding of older log files. By default, seven is the maximum number of log files the server permits to be stored, one for each day of the week. Assuming the default is set, the largest size that the current audit log file can reach is one megabyte.

In either case, if the disk is full, the DHCP server closes the current file and ignores further requests to log audit events until either 12:00 A.M. or until disk status is improved and the disk is no longer full.

Even if audit logged events are ignored because of a disk full condition, the DHCP server continues disk checking every 50 events (or the currently set interval) to determine whether disk conditions have improved. If subsequent disk checks determine that the required amount of server disk space is available, the DHCP server reopens the current log file and resumes logging.

Ending a daily audit log

At 12:00 A.M. local time on the server computer, the DHCP server closes the existing log and moves to the log file for the next day of the week. For example, if the day of the week changes at 12:00 A.M. from Wednesday to Thursday, the log file named DhcpSrvLog-Wed is closed, and the file named DhcpSrvLog-Thu is opened and used for logging events.


DHCP client alternate configuration

With DHCP client alternate configuration, you can easily move a computer between two or more networks, one configured with static IP addresses and one or more configured with DHCP. Alternate configuration provides simplified computer migration (for example, a laptop) between networks without requiring that you reconfigure network adapter parameters such as IP address, subnet mask, default gateway, preferred and alternate Domain Name Service (DNS) servers, and Windows Internet Name Service (WINS) servers.

Configuration options

When you configure TCP/IP properties for a local area network connection, you have the following options:

  • Static IP address configuration

    When you clickUse the following IP address, you can provide values for static IP address settings, such as IP address, subnet mask, default gateway, preferred and alternate DNS servers, and WINS servers. However, if you click Obtain an IP address automatically to change the configuration of your network adapter to a DHCP client configuration, all static IP address settings are lost. Additionally, if you move the computer and configure it for another network, when you return to the original network you will need to reconfigure the computer with the original static IP address settings.

  • Dynamic IP address configuration without alternate configuration

    When you click Obtain an IP address automatically, your computer acts as a DHCP client and obtains IP address, subnet mask, and other configuration parameters from your network DHCP server. If the DHCP server is unavailable, the network adapter is configured using IP autoconfiguration.

  • Dynamic IP address configuration with alternate configuration

    When you click Obtain an IP address automatically, click the Alternate Configuration tab, and type an alternate configuration, you can move your computer between one statically configured network (such as a home network) and one or more dynamically configured networks (such as a corporate network) without changing any settings. If the DHCP server is unavailable (for example, when your computer is connected to your home network), the network adapter is automatically configured with your alternate configuration, and the computer functions correctly on the network. When you move the computer back to the dynamically configured network and the DHCP server is available, the network adapter is automatically configured with the dynamic configuration assigned by the DHCP server. The alternate configuration is used only when the DHCP client cannot locate a DHCP server.

DHCP server discover attempts

If you use DHCP without an alternate configuration and the DHCP client cannot locate a DHCP server, IP autoconfiguration is used to configure the network adapter. The DHCP client continues to attempt to discover a DHCP server on the network every five minutes. If a DHCP server is found, the network adapter is assigned a valid DHCP IP address lease.

If you use DHCP with an alternate configuration, and the DHCP client cannot locate a DHCP server, the alternate configuration is used to configure the network adapter. Normally, there are no additional discovery attempts. However, a DHCP server discovery attempt will occur if:

  • The network adapter is disabled and then enabled again.
  • Media (such as network cabling) is disconnected and then reconnected.
  • The TCP/IP settings for the adapter are changed, and DHCP remains enabled after these changes.

If a DHCP server is found, the network adapter is assigned a valid DHCP IP address lease.

Notes

  • It is possible that a static alternate configuration could conflict with the configuration of another computer on a network. For example, a client using alternate configuration might have the same IP address as another computer on the network. If this occurs, Address Resolution Protocol (ARP) detects the conflict, and the network adapter of the computer configured with the alternate configuration is automatically set to 0.0.0.0. No additional attempts are made to discover a DHCP server, obtain a lease, or use the static alternate configuration.
  • When switching from an alternate configuration to a configuration using IP autoconfiguration, the network adapter is configured with IP autoconfiguration settings (169.254.x.x), and a DHCP server discovery attempt is initiated at the same time. If the discovery is successful, the adapter is assigned a valid DHCP lease.
  • For more information, see To use DHCP client alternate configuration.


DHCP/BOOTP relay agents

This section covers:

  • Understanding relay agents
  • Relay agent configurations
  • Relay agent design issues


Understanding relay agents

A relay agent is a small program that relays DHCP/BOOTP messages between clients and servers on different subnets. DHCP/BOOTP relay agents are part of the DHCP and BOOTP standards and function according to the Request for Comments (RFCs), standard documents that describe protocol design and related behavior.

DHCP/BOOTP router support

In TCP/IP networking, routers are used to interconnect hardware and software used on different physical network segments called subnets and forward IP packets between each of the subnets. To support and use DHCP service across multiple subnets, routers connecting each subnet should comply with DHCP/BOOTP relay agent capabilities described in RFC 1542.

To be compliant with RFC 1542 and provide relay agent support, each router must be able to recognize BOOTP and DHCP protocol messages and process (relay) them appropriately. Because routers interpret DHCP messages as BOOTP messages (such as a UDP message sent through the same UDP port number and containing shared message structure), a router with BOOTP-relay agent capability typically relays DHCP packets and any BOOTP packets sent on the network.

If a router cannot function as a DHCP/BOOTP relay agent, each subnet must have either its own DHCP server or another computer that can function as a relay agent on that subnet. In cases where it is impractical or impossible to configure routers to support DHCP/BOOTP relay, you can configure a computer running Windows NT Server 4.0 or later to act as a relay agent by installing the DHCP Relay Agent service.

In most cases, routers support DHCP/BOOTP relay. If your routers do not, contact your router manufacturer or supplier to find out if a software or firmware upgrade is available to support this feature.

How relay agents work

A relay agent relays DHCP/BOOTP messages that are broadcast on one of its connected physical interfaces, such as a network adapter, to other remote subnets to which it is connected by other physical interfaces. The following illustration shows how client C on Subnet 2 obtains a DHCP address lease from DHCP server 1 on Subnet 1.

DHCP/BOOTP relay agent
  1. DHCP client C broadcasts a DHCP/BOOTP discover message (DHCPDISCOVER) on Subnet 2, as a User Datagram Protocol (UDP) datagram using the well-known UDP server port of 67 (the port number reserved and shared for BOOTP and DHCP server communication).
  2. The relay agent, in this case a DHCP/BOOTP relay-enabled router, examines the gateway IP address field in the DHCP/BOOTP message header. If the field has an IP address of 0.0.0.0, the agent fills it with the relay agent or router's IP address and forwards the message to the remote Subnet 1 where the DHCP server is located.
  3. When DHCP server 1 on remote Subnet 1 receives the message, it examines the gateway IP address field for a DHCP scope that can be used by the DHCP server to supply an IP address lease.

  4. If DHCP server 1 has multiple DHCP scopes, the address in the gateway IP address field (GIADDR) identifies the DHCP scope from which to offer an IP address lease.

    For example, if the gateway IP address (GIADDR) field has an IP address of 10.0.0.2, the DHCP server checks its available set of address scopes for a scope range of addresses that matches the class A IP network that includes the gateway address as a host. In this case, the DHCP server would make a check for a scope of addresses between 10.0.0.1 and 10.0.0.254. If a matching scope exists, the DHCP server selects an available address from the matched scope to use in an IP address lease offer response to the client.

  5. When DHCP server 1 receives the DHCPDISCOVER message, it processes and sends an IP address lease offer (DHCPOFFER) directly to the relay agent identified in the gateway IP address (GIADDR) field.

  6. The router then relays the address lease offer (DHCPOFFER) to the DHCP client.

    The client IP address is still unknown, so it has to be broadcast on the local subnet. Similarly, a DHCPREQUEST message is relayed from client to server, and a DHCPACK message is relayed from server to client, according to RFC 1542.

Note

  • For more information, see Relay agent design issues.


Relay agent configurations

There are several relay agent configuration options available if you plan to incorporate a relay agent into your DHCP/BOOTP-enabled network. These options include using non-Microsoft routers, Windows Server 2003 Routing and Remote Access service, and the DHCP Relay Agent component provided in Windows NT Server 4.0.

Non-Microsoft router

This example shows a non-Microsoft router configuration. The router is running a relay agent forwarding DHCP requests between Subnet A and Subnet B. Typically, the relay agent on the router must be configured with the IP address of the DHCP server.

Non-Microsoft router

The Routing and Remote Access service

This example shows the Windows Server 2003 Routing and Remote Access configuration. The DHCP Relay Agent in the Windows Server 2003 family must be configured with the IP address of the DHCP server in order to relay DHCP requests between Subnet A and Subnet B. For more information about setting up the DHCP Relay Agent, see Configure the DHCP Relay Agent.

Routing and Remote Access

The Windows Server 2003 family

This example shows how a standard IP router can be used with a Windows Server 2003 operating system to relay DHCP requests between Subnet A and Subnet B.

Windows Server and IP Router


Relay agent design issues

There are important design issues to consider before you set up relay agents on your network.

When you have multiple DHCP servers, Microsoft recommends that you place your DHCP servers on different subnets, to achieve a degree of fault tolerance, rather than having all of them on one subnet. The servers should not have common IP addresses in their scopes (each server should have a unique pool of addresses).

If the DHCP server on the local subnet shuts down, requests are relayed to a remote subnet. The DHCP server at that location can respond to DHCP requests if it maintains a scope of IP addresses for the requesting subnet. If the remote server has no scope defined for the requesting subnet, it cannot provide IP addresses even if it has available addresses for other scopes. If each DHCP server has a pool of addresses for each subnet, then it can provide IP addresses for remote clients whose own DHCP server is offline.

Recommended

The following relay agent implementation is recommended for best routed DHCP network performance. It uses two DHCP servers that are attached to two different subnets. The relay agents operating on each of the routers used to connect the subnets have varied delay intervals (one is set to 4 seconds, the other uses no delay). This eliminates the risk of undesirable floods of DHCP packets through randomly selected network paths.

Example: recommended DHCP/BOOTP relay agent configuration

Not recommended

The following relay agent implementation is not recommended. It has the same number of DHCP servers and subnets as in the previous example, but less caution has been used. There is a higher risk of DHCP discovery messages (DHCPDISCOVERs), which are broadcast by the DHCP clients at startup, being randomly forwarded or duplicated when destined for the other subnets. Moreover, the relay agents do not use any delay interval. This increases the likelihood that both relay agents (routers) duplicate any client broadcasted messages, which could potentially flood the remote subnets.

Example: DHCP/BOOTP relay agent configuration not recommended


Administering DHCP

This section provides information about administering DHCP:

  • Managing DHCP from the command line
  • DHCP performance monitoring reference
  • Managing DHCP servers
  • Setting up scopes
  • Setting up options
  • Interoperability issues


Managing DHCP from the command line

The Netsh commands for DHCP offer a command-line tool that helps with the administration of DHCP servers and provides an equivalent alternative to console-based management. This can be useful in the following situations:

  • When managing DHCP servers in wide area networks (WANs), commands can be used in interactive mode at the netsh> command prompt to better manage across slow-speed network links.
  • When managing a large number of DHCP servers, commands can be used in batch mode to help script and automate recurring administrative tasks that need to be performed for all DHCP servers.

For a comprehensive netsh dhcp command reference (including syntax, parameters, and examples), see Netsh commands for DHCP.

Notes

  • For information about how to use the Netsh commands provided for DHCP, see Use DHCP command-line tools.
  • For an example of how to use Netsh commands for DHCP in batch files and scripts, see Netsh DHCP example.
  • For more information about Netsh, see The Netsh command-line utility.


DHCP performance monitoring reference

The Windows Server 2003 DHCP service includes a set of performance counters that can be used to monitor various types of server activity. To access these counters, you must use System Monitor. For more information, see System Monitor.

By default, performance monitoring of DHCP servers is available for use after the DHCP service component is installed. DHCP performance is measured using the following metrics and counters:

Name | Description
Packets Received/sec | The number of message packets received per second by the DHCP server. A large number indicates heavy DHCP-related message traffic to the server.
Duplicates Dropped/sec | The number of duplicated packets per second dropped by the DHCP server. This number can be affected by multiple DHCP relay agents or network interfaces forwarding the same packet to the server. A large number here indicates that either clients are probably timing out too fast or the server is not responding fast enough.
Packets Expired/sec | The number of packets per second that expire and are dropped by the DHCP server. When a DHCP-related message packet is internally queued for 30 seconds or more, it is determined to be stale and expired by the server. A large number here indicates that the server is either taking too long to process some packets while other packets are queued and becoming stale, or traffic on the network is too high for the server to manage.
Milliseconds per packet (Avg.) | The average time in milliseconds used by the DHCP server to process each packet it receives. This number can vary depending on the server hardware and its I/O subsystem. A sudden or unusual increase might indicate a problem, either with the I/O subsystem becoming slower or because of an intrinsic processing overhead on the server computer.
Active Queue Length | The current length of the internal message queue of the DHCP server. This number equals the number of unprocessed messages received by the server. A large number might indicate heavy server traffic.
Conflict Check Queue Length | The current length of the conflict check queue for the DHCP server. This queue holds messages without responses while the DHCP server performs address conflict detection. A large value here might indicate that Conflict Detection Attempts has been set too high or that there is unusually heavy lease traffic at the server.
Discovers/sec | The number of DHCP discover messages (DHCPDISCOVERs) received per second by the server. These messages are sent by clients when they start on the network and obtain a new address lease. A sudden or unusual increase indicates a large number of clients are attempting to initialize and obtain an IP address lease from the server, such as when a number of client computers are started at any given time.
Offers/sec | The number of DHCP offer messages (DHCPOFFERs) sent per second by the DHCP server to clients. A sudden or unusual increase in this number indicates heavy traffic on the server.
Requests/sec | The number of DHCP request messages (DHCPREQUESTs) received per second by the DHCP server from clients. A sudden or unusual increase in this number indicates a large number of clients trying to renew their leases with the DHCP server. This might indicate that scope lease durations are too short.
Informs/sec | The number of DHCP information messages (DHCPINFORMs) received per second by the DHCP server. DHCP inform messages are used when the DHCP server queries for the directory service for the enterprise root and when dynamic updates are being done on behalf of clients by the server.
Acks/sec | The number of DHCP acknowledgment messages (DHCPACKs) sent per second by the DHCP server to clients. A sudden or unusual increase in this number indicates that a large number of clients are being renewed by the DHCP server. This might indicate that scope lease durations are too short.
Nacks/sec | The number of DHCP negative acknowledgment messages (DHCPNAKs) sent per second by the DHCP server to clients. A very high value might indicate potential network trouble in the form of misconfiguration of either the server or clients. When servers are misconfigured, one possible cause is a deactivated scope. For clients, a very high value could be caused by computers moving between subnets, such as laptop portables or other mobile devices.
Declines/sec | The number of DHCP decline messages (DHCPDECLINEs) received per second by the DHCP server from clients. A high value indicates that several clients have found their address to be in conflict, possibly indicating network trouble. In this situation, it can help to enable conflict detection on the DHCP server. This should only be used temporarily. Once the situation returns to normal, it should be turned off.
Releases/sec | The number of DHCP release messages (DHCPRELEASEs) received per second by the DHCP server from clients. This number only exists if a DHCP client sends a release to the server. This can occur manually, such as when the ipconfig command is used at the client computer. Release messages can also be sent by the client if it is configured with the "Release DHCP lease on shutdown" option. Because clients rarely release their address, the value of this counter remains low for many DHCP network configurations. For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Note

  • Values for the following registry key can be used by a member of the local Administrators group:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Performance

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

    By changing values stored at this registry path location, you can deny or modify permissions that determine who can view System Monitor counters used for the DHCP server on the server computer. Values under this key are used by the System Monitor DLL (Perfctrs.dll) to identify each of the counters described. For more information, see System Monitor.


Managing DHCP servers

This section covers:

  • Authorizing DHCP servers
  • Monitoring DHCP server performance
  • Restoring server data
  • Backing up the DHCP database
  • Analyzing server log files
  • Cluster support for DHCP servers


Authorizing DHCP servers

The Windows Server 2003 family provides integrated security support for networks that use Active Directory. This support adds and uses a class of objects that is part of the base directory schema, providing the following enhancements:

  • A list of IP addresses available for the computers that you authorize to operate as DHCP servers on your network.
  • Detection of unauthorized DHCP servers and prevention of their starting or running on your network.

The following sections discuss:

  • Background information about the detection of unauthorized DHCP servers.
  • How computers are authorized in Active Directory to provide DHCP service.
  • How an unauthorized server is detected and prevented from providing DHCP service.
  • Notes and limitations for implementing DHCP service, depending on whether the Active Directory directory service is available.

Background on unauthorized DHCP servers

When configured correctly and authorized for use on a network, DHCP servers provide a useful and intended administrative service. However, when a misconfigured or unauthorized DHCP server is introduced into a network, it can cause problems. For example, if an unauthorized DHCP server starts, it might begin either leasing incorrect IP addresses to clients or negatively acknowledging DHCP clients attempting to renew current address leases.

Either of these configurations can produce further problems for DHCP-enabled clients. For example, clients that obtain a configuration lease from the unauthorized server can fail to locate valid domain controllers, preventing clients from successfully logging on to the network.

To resolve these issues, DHCP servers running Windows Server 2003 are verified as authorized in Active Directory before they can service clients. This avoids most of the accidental damage caused by running DHCP servers with incorrect configurations or correct configurations on the wrong network.

How DHCP servers are authorized

The authorization process for DHCP server computers depends on the installed role of the server on your network. In the Windows Server 2003 family there are three roles or server types for which each server computer can be installed:

  • Domain controller. The computer keeps and maintains a copy of the Active Directory database and provides secure account management for domain member users and computers.
  • Member server. The computer is not operating as a domain controller but has joined a domain in which it has a membership account in the Active Directory database.
  • Stand-alone server. The computer is not operating as a domain controller or a member server in a domain. Instead, the server computer is made known to the network through a specified workgroup name, which can be shared by other computers, but is used only for browsing purposes and not to provide secured logon access to shared domain resources.

If you deploy Active Directory, all computers operating as DHCP servers must be either domain controllers or domain member servers before they can be authorized and provide DHCP service to clients.

Although it is not recommended, you can use a stand-alone server as a DHCP server as long as it is not on a subnet with any authorized DHCP servers. When a stand-alone DHCP server detects an authorized server on the same subnet, it automatically stops leasing IP addresses to DHCP clients.

For more information about DHCP server installation, see To install a DHCP server and To open the DHCP console.

For more information about authorizing a DHCP server in Active Directory, see To authorize a DHCP server in Active Directory.

For more information about delegating administrative credentials, see To delegate ability to authorize DHCP servers to a non-enterprise administrator.

How unauthorized servers are detected

DHCP servers running Windows Server 2003 provide detection of both authorized and unauthorized servers using the following specific enhancements for the DHCP standard:

  • The use of information messaging between DHCP servers using the DHCP information message (DHCPINFORM).
  • The addition of several new vendor-specific option types, for communicating information about the root domain.

A DHCP server running Windows Server 2003 uses the following process to determine whether Active Directory is available. If found, the server ensures that it is authorized by adhering to the following procedure, depending on whether it is a member server or a stand-alone server:

  • For member servers (a server joined to a domain that is part of the enterprise), the DHCP server queries Active Directory for the list of authorized DHCP server IP addresses.

    If the server finds its IP address in the authorized list, it initializes and starts providing DHCP service to clients. If it does not find itself in the authorized list, it does not initialize and stops providing DHCP services.

    When installed in a multiple forest environment, DHCP servers seek authorization from within their forest only. Once authorized, DHCP servers in a multiple forest environment lease IP addresses to all reachable clients. Therefore, if clients from another forest are reached using routers with DHCP/BOOTP forwarding enabled, the DHCP server leases IP addresses to them.

    If Active Directory is not available, the DHCP server continues to operate in its last known state.

  • For stand-alone servers (a server not joined to any domain or part of an existing enterprise). When the DHCP service starts, it sends a DHCP information message (DHCPINFORM) request to the reachable network, using the local limited broadcast address (255.255.255.255) to locate the root domain on which other DHCP servers are installed and configured.

    This message includes several vendor-specific option types that are known and supported by other DHCP servers running Windows Server 2003. When received by other DHCP servers, these option types enable the query and retrieval of information about the root domain. When queried, the other DHCP servers reply with DHCP acknowledgement messages (DHCPACK) to both acknowledge and answer with Active Directory root domain information.

    If the stand-alone server receives no reply, it initializes and starts providing DHCP services to clients. If the stand-alone server receives a reply from a DHCP server that is authorized in Active Directory, the stand-alone server does not initialize and does not provide DHCP services to clients.

Authorized servers repeat the detection process at a default interval of 60 minutes. Unauthorized servers repeat the detection process at a default interval of 10 minutes.

Efforts to detect unauthorized servers are noted as "Restarting rogue detection" entries in the audit log.

Notes

  • The process of authorizing DHCP servers is useful only for DHCP servers running Windows 2000 or Windows Server 2003.
  • When a DHCP server running Windows Server 2003 is installed in a Windows NT 4.0 domain, the server initializes and begins serving DHCP clients in the absence of directory services. However, if there is a Windows Server 2003 domain on the same subnet or on a connected network with routers configured for DHCP or BOOTP forwarding, the DHCP server in the Windows NT 4.0 domain detects its own unauthorized status and ceases to provide IP address leases to clients. If you authorize the DHCP server in Active Directory, it can provide DHCP service to the clients in the Windows NT 4.0 domain.
  • For the directory authorization process to work properly, it is necessary that the first DHCP server introduced on your network participate in Active Directory. This requires that the server be installed as either a domain controller or a member server. When planning or deploying Active Directory with Windows Server 2003 DHCP, it is important that you do not install your first DHCP server as a stand-alone server.
  • Most commonly, there is one enterprise root and, therefore, only a single point for directory authorization of the DHCP servers. However, there is no restriction on authorizing DHCP servers for more than one enterprise root.
  • The fully qualified domain name (FQDN) of the DHCP server cannot exceed 64 characters. If the FQDN of the DHCP server exceeds 64 characters, the attempt to authorize the server fails with the error message, "A constraint violation has occurred." If your DHCP server FQDN exceeds 64 characters, authorize the server using the server’s IP address instead of its FQDN.
  • DHCP servers running Windows 2000 cannot be authorized using the Windows Server 2003 administrative tools (the DHCP console and the Netsh commands for DHCP) unless Windows 2000 Server Service Pack 2 is installed.


Monitoring DHCP server performance

Because DHCP servers are of critical importance in most environments, monitoring their performance can help in troubleshooting cases where server performance has been degraded.

The Windows Server 2003 family provides a set of DHCP server performance counters that can be used to measure and monitor various aspects of server activity, such as the following:

  • All types of DHCP messages sent and received by the DHCP service.
  • The average amount of processing time spent by the DHCP server per message packet sent and received.
  • The number of message packets dropped because of internal delays at a DHCP server computer.

For more information, see DHCP performance monitoring reference.


Restoring server data

Restoring the DHCP server database is useful in situations where the database has either become corrupted or lost. In order to successfully restore the database, you need to back up the database on a regular basis. By default, DHCP performs synchronous backups that occur automatically at a 60 minute interval to the folder location systemroot\System32\Dhcp\Backup, but you can also perform manual backups, or use backup software to copy the database to other locations. For more information, see Backing up the DHCP database and Backing up and restoring data.

You can restore the DHCP database from a backup copy of the database file, Dhcp.mdb, using the Restore command on the Action menu in the DHCP console. When you restore the DHCP database from a backup copy of Dhcp.mdb, the following information is configured on the server:

  • All scopes, including superscopes and multicast scopes
  • Reservations
  • Leases
  • All options, including server options, scope options, reservation options, and class options
  • All registry keys and other configuration settings (for example, audit log settings and folder location settings) set in DHCP server properties.

Note

  • The DNS dynamic update credentials (user name, domain, and password) that the DHCP server uses when registering DHCP client computers in DNS are not backed up with any backup method, therefore they are not restored during the restore procedure. After restoring your DHCP database, configure credentials for your server. For more information, see To configure DNS dynamic update credentials.

For more information, see To restore the DHCP database and To move a DHCP database to another server.


Backing up the DHCP database

Maintaining a backup of the DHCP database protects you from data loss if the DHCP database is lost (for example, due to hard disk failure) or becomes corrupted. There are three backup methods supported by the DHCP Server service:

  • Synchronous backups that occur automatically. The default backup interval is 60 minutes.
  • Asynchronous (manual) backups, performed by using the Backup command on the DHCP console. For more information about asynchronous backups, see To back up the DHCP database.
  • Backups using Windows Backup (ntbackup.exe) or non-Microsoft backup software. For more information about Windows Backup, see Backing up and restoring data.

When a synchronous or asynchronous backup occurs, the entire DHCP database is saved, including the following:

  • All scopes, including superscopes and multicast scopes
  • Reservations
  • Leases
  • All options, including server options, scope options, reservation options, and class options
  • All registry keys and other configuration settings (for example, audit log settings and folder location settings) set in DHCP server properties. These settings are stored in the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters

    To back up this subkey, open Registry Editor, and save the specified key to a text file. For more information, see To open Registry Editor and Import or export registry keys.

Note

  • The DNS dynamic update credentials (user name, domain, and password) that the DHCP server uses when registering DHCP client computers in DNS are not backed up with any backup method.

Backup locations

The default DHCP database backup path is systemroot\System32\Dhcp\Backup. You can change the database backup folder by selecting a different local folder during a manual backup or by changing the backup folder location in DHCP server properties. For more information, see To set the DHCP database backup path.

When planning your backup strategy, consider the following:

  • Synchronous backups are performed while the DHCP service is running. Similarly, when you perform asynchronous (manual) backups, you do not need to stop the DHCP service unless you are moving your database to a new server. For more information, see To move a DHCP database to another server.
  • The backup folder location must be a local path.

Notes

  • This topic assumes that the DHCP database and its backup directories are located on the default drive and path locations.

  • The default automatic database backup interval is 60 minutes. You can change the automatic backup interval through the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\BackupInterval

    • Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
  • Do not store DHCP server backups on the same hard drive on which the DHCP service is installed, and make sure that the access control list (ACL) for the backup folder contains only the Administrators group and the DHCP Administrator group as members. In addition to performing manual backups, back up to other locations, such as a tape drive, and make sure that unauthorized persons do not have access to your backup copies. You can use Windows Backup for this purpose. For more information, see Best practices for Backup.


Analyzing server log files

In Windows Server 2003 family, DHCP server log files are designed to use Audit logging to permit log files to remain enabled for use without requiring added monitoring or administering to manage log file growth or conserve disk resources. DHCP audit logs are located by default at %windir%\System32\Dhcp.

The following section outlines the format of these log files and how they can be used to gather more information about DHCP Server service operations on the network.

DHCP server log file format

DHCP server logs are comma-delimited text files with each log entry representing a single line of text. Following are the fields (and the order in which they appear) in a log file entry:

ID, Date, Time, Description, IP Address, Host Name, MAC Address

Each of these fields is described in detail in the following table:

Field | Description
ID | A DHCP server event ID code.
Date | The date on which this entry was logged on the DHCP server.
Time | The time at which this entry was logged on the DHCP server.
Description | A description of this DHCP server event.
IP Address | The IP address of the DHCP client.
Host Name | The host name of the DHCP client.
MAC Address | The media access control address used by the network adapter hardware of the client.

DHCP server log: Common event codes

DHCP server audit log files use reserved event ID codes to provide information about the type of server event or activity logged. The following table describes these event ID codes in more detail.

Event ID | Description
00 | The log was started.
01 | The log was stopped.
02 | The log was temporarily paused due to low disk space.
10 | A new IP address was leased to a client.
11 | A lease was renewed by a client.
12 | A lease was released by a client.
13 | An IP address was found in use on the network.
14 | A lease request could not be satisfied because the address pool of the scope was exhausted.
15 | A lease was denied.
20 | A BOOTP address was leased to a client.

DNS dynamic update events

When the DHCP server is configured to perform DNS dynamic updates on behalf of DHCP clients, you can use the DHCP audit logs to monitor update requests by the DHCP server to the DNS server, DNS record update successes, and DNS record update failures. The following event ID's are used for DNS dynamic update events:

ID number | DHCP Event
30 | DNS dynamic update request
31 | DNS dynamic update failed
32 | DNS dynamic update successful

The IP address of the DHCP client computer is included in the DHCP audit log, providing the ability to track the source in the event of a denial of service attack.

DHCP server logs: Server authorization events

The following are additional server log event ID codes and descriptions. These events can appear in logs made by DHCP servers running Windows Server 2003. They pertain to the applicable DHCP server and its authorization status when deployed in Active Directory environments.

Event ID Description
50 Unreachable domain

The DHCP server could not locate the applicable domain for its configured Active Directory installation.
51 Authorization succeeded

The DHCP server was authorized to start on the network.
52 Upgraded to a Windows Server 2003 operating system

The DHCP server was recently upgraded to a Windows Server 2003 operating system, and, therefore, the unauthorized DHCP server detection feature (used to determine whether the server has been authorized in Active Directory) was disabled.
53 Cached Authorization

The DHCP server was authorized to start using previously cached information. Active Directory was not currently visible at the time the server was started on the network.
54 Authorization failed

The DHCP server was not authorized to start on the network. When this event occurs, it is likely followed by the server being stopped.
55 Authorization (servicing)

The DHCP server was successfully authorized to start on the network.
56 Authorization failure, stopped servicing

The DHCP server was not authorized to start on the network and was shut down by the operating system. You must first authorize the server in the directory before starting it again. For more information, see To authorize a DHCP server in Active Directory.
57 Server found in domain

Another DHCP server exists and is authorized for service in the same domain.
58 Server could not find domain

The DHCP server could not locate the specified domain.
59 Network failure

A network-related failure prevented the server from determining if it is authorized.
60 No DC is DS Enabled

No Windows Server 2003 domain controller (DC) was located. For detecting whether the server is authorized, a DC that is enabled for Active Directory is needed.
61 Server found that belongs to DS domain

Another DHCP server was found on the network that belongs to the Active Directory domain.
62 Another server found

Another DHCP server was found on the network.
63 Restarting rogue detection

The DHCP server is trying once more to determine whether it is authorized to start and provide service on the network.
64 No DHCP enabled interfaces

The DHCP server has its service bindings or network connections configured so that it is not enabled to provide service. This usually means one of the following:

  1. The network connections of the server are either not installed or not actively connected to a network. For more information, see the Hardware troubleshooter in the List of troubleshooters.
  2. The server has not been configured with at least one static IP address for one of its installed and active network connections. For more information, see To configure TCP/IP for static addressing.
  3. All of the statically configured network connections for the server are disabled. For more information, see Multihomed DHCP servers.

Example: Excerpt from a sample DHCP server audit log

The following is a brief excerpt of sample log activity from an audit log generated by the DHCP Server service:

ID Date,Time,Description,IP Address,Host Name,MAC Address
00,04/19/99,12:43:06,Started,,,
60,04/19/99,12:43:21,No DC is DS Enabled,,MYDOMAIN,
63,04/19/99,12:43:28,Restarting rogue detection,,,
01,04/19/99,13:11:13,Stopped,,,
00,04/19/99,12:43:06,Started,,,
55,04/19/99,12:43:54,Authorized(servicing),,MYDOMAIN,

In this sample, the DHCP server could not be authorized when initially started and is subsequently stopped. Once authorized, the server is then able to start and service clients.

Note

  • For more information, see Audit logging.


Cluster support for DHCP servers

The Windows Server 2003 DHCP Server service is a cluster-aware application. You can implement additional DHCP (or MADCAP) server reliability by deploying a DHCP server cluster using the Cluster service provided with XOX.

By using clustering support for DHCP, you can implement a local method of DHCP server failover, achieving greater fault tolerance. You can also enhance fault tolerance by combining DHCP server clustering with a remote failover configuration, such as by using a split scope configuration.

Requirements for setting up a DHCP clustered resource

The DHCP Server service, when used in a server cluster, requires the following resource types: a disk resource, an IP address resource, and a name resource.

In this type of configuration, a virtual IP address is defined for the IP address resource using the Cluster Administrator tool. This address must be a static IP address, not one obtained from another DHCP server.

The DHCP Server service then binds to this virtual IP address. This IP address must then be used to authorize the DHCP Server service in Active Directory so it can function correctly and service clients on the network.

Once the virtual IP is set using cluster configuration, each network adapter installed on each node (that is, a server in the cluster) needs an IP address configuration. Because the DHCP Server service does not bind to adapter IP addresses, you can either provide them through DHCP or configure them statically. If you use static configuration, the IP addresses for each linked pair of network adapters (linked node-to-node) should be from the same subnet.

Addresses that are statically configured using TCP/IP properties from the Network Connections folder can also be viewed through server bindings properties in the DHCP console. However, for a DHCP server cluster, the bindings information that appears in these views does not correspond to the virtual IP address used for the server cluster. Therefore, these settings do not apply.

When a scope is created for a DHCP clustered server, the virtual IP addresses used in the cluster context must be excluded so that they are not distributed to clients. Additionally. you should configure the database path, audit log file path, and the database backup path using the Cluster Administrator tool on the shared disk.

Other options for DHCP failover

Another way to implement DHCP remote failover is to deploy two DHCP servers in the same network that share a split scope configuration based on the 80/20 rule. For more information, see Using the 80/20 rule for scopes.

For more information about installing a DHCP resource type on a XOX, cluster server, see Checklist: Installing a DHCP Service resource.

Notes

  • The Jet database upon which the DHCP Server service relies is not cluster aware. If the clustered DHCP database becomes inaccessible to the DHCP Server service, the service will report thousands of ESENT application log errors, and DHCP service by the cluster will be interrupted.
  • If you need only to remotely manage DHCP server clusters that are deployed on remote computers running XOX, you can use Cluster Administrator to do this.
  • For more information about configuring DHCP clustering, see "Dynamic Host Configuration Protocol" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Setting up scopes

This section covers:

  • Configuring scopes
  • Using superscopes
  • Using multicast scopes
  • Removing scopes
  • Managing leases
  • Using client reservations
  • Reconciling scopes


Configuring scopes

A scope is an administrative grouping of IP addresses for computers on a subnet that use the DHCP service. The administrator first creates a scope for each physical subnet and then uses the scope to define the parameters used by clients. A scope has the following properties:

  • A range of IP addresses from which to include or exclude addresses used for DHCP service lease offerings.
  • A subnet mask, which determines the subnet for a given IP address.
  • A scope name assigned when it is created.
  • Lease duration values, which are assigned to DHCP clients that receive dynamically allocated IP addresses.
  • Any DHCP scope options configured for assignment to DHCP clients, such as DNS server, router IP address, and WINS server address.
  • Reservations, optionally used to ensure that a DHCP client always receives the same IP address.

Before adding scopes

A DHCP scope consists of a pool of IP addresses on a given subnet, such as 192.168.0.1 to 192.168.0.254, that the DHCP server can lease to clients.

Each subnet can have only a single DHCP scope with a single continuous range of IP addresses. To use several address ranges within a single scope or subnet for DHCP service, you must first define the scope and then set any needed exclusion ranges.

  • Defining the scope

    Use the entire range of consecutive IP addresses that make up the local IP subnet for which you are enabling DHCP service.

  • Setting exclusion ranges

    You should set exclusion ranges for any IP addresses within the scope that you do not want the DHCP server to offer or use for DHCP assignment. For example, you can exclude the first 10 addresses in the previous example scope by creating an exclusion for 192.168.0.1 to 192.168.0.10.

    By setting an exclusion for these addresses, you specify that DHCP clients are never offered these addresses when they request leased configuration from the server. Excluded IP addresses can be active on your network, but only by manually configuring these addresses at hosts that do not use DHCP to obtain an address.

Creating scopes

When you create a DHCP scope, you use the DHCP console to enter the following required information:

  • A scope name, assigned by you or the administrator who created the scope.
  • A subnet mask used to identify the subnet to which an IP address belongs.
  • A range of IP addresses contained within the scope.
  • A time interval (known as a lease duration) that specifies how long a DHCP client can use an assigned IP address before it must renew its configuration with the DHCP server.

Using the 80/20 rule for scopes

For balancing DHCP server usage, a good practice is to use the "80/20" rule to divide the scope addresses between the two DHCP servers. If Server 1 is configured to make available most (approximately 80%) of the addresses, then Server 2 can be configured to make the other addresses (approximately 20%) available to clients. The following illustration is an example of the 80/20 rule:

80/20 rule

Notes

  • For detailed information on applying the 80/20 rule, see Best practices.
  • When creating a new scope, the IP address used to create it should not include addresses of existing statically configured computers, such as the DHCP server. Either these static addresses should be outside the range for the scope, or they should be excluded from the scope address pool.

After scopes are added

After you define a scope, you can additionally configure the scope by performing the following tasks:

  • Set additional exclusion ranges.

    You can exclude any other IP addresses that must not be leased to DHCP clients. You should use exclusions for all devices that must be statically configured. The excluded ranges should include all IP addresses that you assigned manually to other DHCP servers, non-DHCP clients, diskless workstations, or Routing and Remote Access and PPP clients.

  • Create reservations.

    You can choose to reserve some IP addresses for permanent lease assignment to specified computers or devices on your network. You should make reservations only for devices that are DHCP-enabled and that must be reserved for specific purposes on your network (such as print servers).

  • Adjust the length of lease durations.

    You can modify the lease duration to be used for assigning IP address leases. The default lease duration is eight days.

    For most LANs, the default value is acceptable but can be further increased if computers seldom move or change locations. Also, infinite lease times can be set but should be used with caution. For information about circumstances under which modifying this setting is most useful, see Managing leases.

  • Configure options and classes to be used with the scope.

    To provide full configuration for clients, DHCP options need to be configured and enabled for the scope. For more information, see Setting up options.

    For more advanced discrete management of scope clients, you can add or enable user or vendor-defined option classes. For more information, see Using option classes.

Notes

  • After you define and configure a scope, the scope must be activated before the DHCP server begins providing service to clients. However, you should not activate a new scope until you have specified the DHCP options for it. For information on how to activate a scope, see To activate a scope.
  • After you activate a scope, you should not change the range of scope addresses.


Using superscopes

A superscope is an administrative feature of DHCP servers running Windows Server 2003 that you can create and manage through the DHCP console. Using a superscope, you can group multiple scopes as a single administrative entity. With this feature, a DHCP server can:

  • Support DHCP clients on a single physical network segment (such as a single Ethernet LAN segment) where multiple logical IP networks are used. When more than one logical IP network is used on each physical subnet or network, such configurations are often called multinets.
  • Support remote DHCP clients located on the far side of DHCP and BOOTP relay agents (where the network on the far side of the relay agent uses multinets).

In multinet configurations, you can use DHCP superscopes to group and activate individual scope ranges of IP addresses used on your network. In this way, the DHCP server computer can activate and provide leases from more than one scope to clients on a single physical network.

Superscopes can resolve certain types of DHCP deployment issues for multinets, including situations in which:

  • The available address pool for a currently active scope is nearly depleted, and more computers need to be added to the network. The original scope includes the full addressable range for a single IP network of a specified address class. You need to use another IP network range of addresses to extend the address space for the same physical network segment.
  • Clients must be migrated over time to a new scope (such as to renumber the current IP network from an address range used in an existing active scope to a new scope that contains another IP network range of addresses).
  • You want to use two DHCP servers on the same physical network segment to manage separate logical IP networks.

Superscope configurations for multinets

The following section shows how a simple DHCP network consisting originally of one physical network segment and one DHCP server, can be extended to use superscopes for support of multinet configurations.

Example 1: Non-routed DHCP server (before superscope)

In this preliminary instance, a small local area network (LAN) with one DHCP server supports a single physical subnet, Subnet A. The DHCP server in this configuration is limited to leasing addresses to clients on this same physical subnet.

The following illustration shows this example network in its original state. At this point, no superscopes have been added and a single scope, Scope 1, is used to service all DHCP clients on Subnet A.

Example 1: Single subnet and DHCP server (before superscope)

Example 2: Superscope for non-routed DHCP server supporting local multinets

To include multinets implemented for client computers on Subnet A, the same network segment where the DHCP server is located, you can configure a superscope which includes as members: the original scope (Scope 1) and additional scopes for the logical multinets for which you need to add support (Scope 2, Scope 3).

This illustration shows the scope and superscope configuration to support the multinets on the same physical network (Subnet A) as the DHCP server.

Example 2: Superscope for non-routed DHCP server supporting local multinets

Example 3: Superscope for routed DHCP server with relay agent supporting remote multinets

To include multinets implemented for client computers on Subnet B, the remote network segment located across a router from the DHCP server on Subnet A, you can configure a superscope which includes as members: the additional scopes for the logical multinets for which you need to add remote support (Scope 2, Scope 3).

Note that since the multinets are for the remote network (Subnet B), the original scope (Scope 1) does not need to be part of the added superscope.

This illustration shows the scope and superscope configuration to support the multinets on the remote physical network (Subnet B) away from the DHCP server.

Example 3: Superscope for routed DHCP server with relay agent supporting remote multinets

Note

  • A DHCP relay agent is used for DHCP servers to support clients on remote subnets, as shown in Example 3. For more information, see Understanding relay agents.


Using multicast scopes

Multicast scopes are supported through the use of Multicast Address Dynamic Client Allocation Protocol (MADCAP), a proposed standard protocol for performing multicast address allocation. The MADCAP protocol describes how multicast address allocation (or MADCAP) servers can dynamically provide IP addresses to other computers (MADCAP clients) on your network.

Typically, a MADCAP client might also be a multicast server (MCS) used to support IP multicasting. An MCS manages the shared or group use of the allocated multicast IP address and streams data traffic to members that share the use of the specified group address.

Once an MCS is configured and allocated a group IP address to use, any multicast clients that have registered their membership with the MCS can receive streams sent to this address. By registering with the MCS, clients can participate efficiently in the stream process, such as for real-time video or audio network transmissions. The MCS also manages the multicast group list, updating its membership and status so that multicast traffic is received by all current members.

Background on multicast addresses

Ordinarily, you use DHCP scopes to provide client configurations by allocating ranges of IP addresses from the standard address classes, Class A, B, or C. By using DHCP scopes you can assign IP addresses from the ranges provided by these classes for your DHCP clients to be configured to use unicast (or point-to-point) directed communication between other TCP/IP networked computers.

The multicast address range uses an additional address class, Class D, that includes IP addresses that range from 224.0.0.0 to 239.255.255.255 for use in IP multicasting. Addresses in this class are used for multicasting only and not for regular DHCP scopes.

In all TCP/IP networks, each host is required to first be configured with its own IP address, taken from one of the standard address classes. You must assign this required unicast IP address before you can configure a host to support and use secondary IP addresses, such as a multicast IP address.

Another difference between unicast and multicast addresses, is that a group of TCP/IP host computers are intended to be able to share the use of a multicast IP address. This is not normally the case with unicast IP addresses, which are intended to be assigned individually to only one configured host and not shared with other hosts.

When the destination address for an IP datagram is an IP multicast address, the datagram is forwarded to all members of a multicast group, which is a set of zero or more hosts identified by the address. The membership of a multicast group is dynamic in that individual hosts can join or leave the group at any time.

Membership and use of multicast groups is unrestricted and can be compared to membership and use of a group e-mail address: Group membership can be any size, and hosts can be members of many multicast groups.

You can permanently reserve multicast group addresses or temporarily assign and use them as needed on your network. For a permanent group IP address to be reserved for Internet use, you must register it with the Internet Assigned Numbers Authority (IANA).

For multicast IP addresses not permanently reserved with the IANA, all Class D addresses that remain unreserved can then be used dynamically to assign and form temporary multicast groups. These temporary groups can exist as long as one or more hosts on the network are configured with the group address and actively share its use.

For more information, see Understanding multicasting or Internet Group Management Protocol (IGMP).

Determining the ranges to use for multicast scopes

When deciding the IP address ranges to use for multicast scopes on your MADCAP server, there are two overall best practices recommended by the Multicast Allocation (MALLOC) working group, an IETF team of industry volunteers who help establish multicast address allocation standards. These practices include:

  • Administrative scoping This is most useful when you are using multicast IP addresses privately in your own network. It is similar to private IP addressing, as used currently in the unicast IP address spaces (such as the use of the 10.0.0.0 network address space). It is fully discussed in RFC 2365, "Administratively Scoped IP Multicast."

    With administratively scoped multicast IP, the range most recommended that you begin with is the 239.192.0.0 range. This range is known as the IPv4 Organization Local Scope and has a subnet mask of 255.252.0.0 (14-bits in length). It is intended for use by an entire organization setting multicast scopes privately for its own internal or organizational use. Starting with this address, you can create a considerable number of addresses—up to 218, or 262,144 group addresses—for use in all subnets within your organization's network.

    For more information, refer directly to the RFC, which can be obtained at the Request for Comments Web site.

  • Global scoping This practice is most useful when you are using multicast group IP addresses in a public network address space, particularly the Internet.

    Because most organizations requiring one or more public addresses likely have already been assigned some public unicast IP addresses, a subnet allocation scheme has been proposed. For MADCAP, the 233.0.0.0 range of the Class D address space is recommended for use as a global scope range.

    When the 233.0.0.0 range is used, the allocation of global addresses works in the following way:

    1. A network registry, such as the Internet Assigned Numbers Authority (IANA), allocates and reserves the first 8 bits of the range (for example, the "233" portion of this range).
    2. The next 16 bits (the two middle octet numbers of addresses in this range) are based on a previously assigned Autonomous System (AS) number. This number is recorded with the applicable Internet Assigned Numbers Authority (IANA) registry for your region.

      If you already register your IP addresses with a regional network registry, you might know your AS number. You can also look it up easily using the Whois database system on the Internet. If you are obtaining IP addresses through an Internet service provider (ISP), you might contact them to find out what your AS number is.

      AS numbers are allocated to the regional registries by the IANA. If you or your ISP are located in the United States, you can apply directly to the American Registry for Internet Numbers (ARIN) to obtain an AS number. For more information, see the ARIN Web site.

      For other regions, AS numbers can also be obtained from appropriate regional registries. Other regional registries include the following:

      • ARIN or <hostmaster@arin.net> for the Americas, Caribbean, and Africa.
      • RIPE-NCC <ncc@ripe.net> for Europe.
      • AP-NIC <admin@apnic.net> for the Asia-Pacific region.
    3. The last 8 bits in the address are local use bits.

      These provide the IP address range from which to configure any multicast scopes for group addresses you want to use publicly on the Internet. With this global scoping system in use, a subnet mask of 255.255.255.0 should be applied. This provides each organization with an assigned AS number of up to 255 multicast group addresses for use on the Internet.

    • For more information on either the practice of global scoping for multicast address allocation or the use and allocation of AS numbers, use the IETF Web site. For global scoping, refer directly to the current available draft entitled "Static Allocation in 233/8," and for more information on AS numbering, refer to RFC 1930, "Guidelines for creation, selection, and registration of an Autonomous System (AS)."

MADCAP and DHCP

The Windows Server 2003 DHCP service supports both the DHCP and MADCAP protocols. These protocols function separately and are not dependent on each other. For example, a DHCP client might or might not be a MADCAP client and a MADCAP client might or might not be a DHCP client.

It is also worth mentioning that the DHCP Server service can be used to deploy MADCAP servers independent of how DHCP servers are used on your network. For example, to install Windows Server 2003 DHCP for MADCAP service only:

  1. Create multicast scopes.
  2. Do not create other scopes or superscopes.

Only where other scopes or superscopes are configured does the server computer also function as a DHCP server.

For more information about MADCAP, see Multicast address allocation.

Important

  • Multicast scopes and MADCAP only provide a mechanism for dynamically allocating IP address configuration for multicast-ranged IP addresses. Other network configuration details are normally required to enable multicasting for your deployment needs. For more information, see Checklist: Installing IP multicast video conferencing.

Notes

  • Multicast scopes do not require or support the use of DHCP options, but can be configured with a finite lifetime, enabling the multicast scope to expire and be removed by the server.
  • XOX
  • For more information, see Manage multicast scopes.


Removing scopes

When a subnet is no longer in use, or any other time you want to remove an existing scope, you can remove it at the DHCP console. In most cases, scopes are removed only when you need to renumber your network to use a different IP address range.

To retire a current scope and renumber your network to use a different scope, be sure to do the following first:

  1. Create the new scope using a different range of addresses.
  2. Configure options for the new scope.
  3. Activate the new scope and deactivate the old scope.
  4. When all clients are no longer using the old scope, remove the old scope.

Scope migration strategies

To remove old scopes without disrupting DHCP service to clients on the subnet, use the following suggestions to design your scope migration strategy:

  • Activate a new replacement scope for the subnet before the old scope is deactivated. You can create a replacement scope on a different DHCP server or on the same server.
  • Deactivate a scope before removing it. After a scope is deactivated, it does not acknowledge lease or renewal requests. DHCP clients will be unable to renew their leases from the deactivated scope and the original server, so the clients will seek new leases from an available DHCP server.
  • Superscopes, reservations, and exclusion ranges can be used individually or together to provide a smooth migration of clients from one scope to another. For example, you can create a superscope that contains both a new scope and the original scope that has been targeted for deactivation. If you create an exclusion range on the original scope, clients with leases that fall within the exclusion range are unable to renew their leases and are assigned leases from the new scope instead. Or, if you create reservations for clients in the new scope, when a client attempts to renew its lease from the original scope, the client is instead assigned the address for which a reservation has been configured.

Note

  • When manually reconfiguring XOX-based client computers, you can use the commands ipconfig /release and ipconfig /renew at the command prompt to release an old IP address and acquire a new lease from a replacement scope.


Managing leases

IP addresses are leased by the DHCP server to its clients. Each lease has an expiration date, which the client must renew if it is going to continue to use that address.

Leases are retained in the DHCP server database four hours after expiration. This grace period protects a client lease in case the client and server are in different time zones, the individual computer clocks are not synchronized, or the client computer is off the network when the lease expires. Expired leases are included in the list of active leases and are distinguished by a different icon.

You can delete the lease of any DHCP client in the scope. The main reason for doing so is to remove a lease that conflicts with an IP address exclusion or a client reservation that you want to add. Deleting a lease has the same effect as if the client lease expired: the next time that client computer starts, it must enter the initialization state and obtain new TCP/IP configuration information from a DHCP server. There is nothing, however, to prevent the client from obtaining a new lease for the same IP address. You must make the address unavailable before the client requests another lease.

Delete only entries for clients that are no longer using the assigned DHCP lease or that are to be moved immediately to a new address. Deleting an active client could result in duplicate IP addresses on the network, because deleted addresses will be assigned to new active clients. After you delete the lease of the client and set a reservation or exclusion, you should always use ipconfig /release on the client computer to force the client to free its IP address.

Note

  • You can view lease information for individual clients by first selecting the Active Leases folder for a scope in the DHCP console. When Active Leases for a scope is selected as the console view, the list of currently active client leases for the scope appears in the details pane.

Modifying default lease durations for a scope

When a scope is created, the default lease duration is set to eight days. In most cases, this value is sufficient. However, because lease renewal is an ongoing process that can affect the performance of DHCP clients and your network, it is sometimes useful to change the lease duration. Use the following guidelines to decide how to best modify lease duration settings for improving DHCP performance on your network:

  • If you have a large number of IP addresses available and configurations that rarely change on your network, increase the lease duration to reduce the frequency of lease renewal queries between clients and the DHCP server. This reduces some network traffic caused by clients renewing their leases.
  • If you have a limited number of IP addresses available and if client configurations change or clients move often on your network, reduce the lease duration to promote scavenging of old IP addresses by the DHCP server. This increases the rate at which addresses are returned to the available address pool for reassignment to new clients.

Note

  • You can also set a separate lease time, different from the default scope lease time used by your DHCP clients, such as alternate lease times for supporting other types of clients such as BOOTP or Routing and Remote Access clients. For more information, see Manage BOOTP and remote access clients.


Using client reservations

With client reservations, you can reserve a specific IP address for permanent use by a DHCP client. Typically, you will need to do this if the client uses an IP address that was assigned using another method for TCP/IP configuration.

If multiple DHCP servers are configured with a scope that covers the range of the reserved IP address, the client reservation must be made and duplicated at each of these DHCP servers. Otherwise, the reserved client computer can receive a different IP address, depending on the responding DHCP server.

If you want to change a reserved IP address for a current client, you have to remove the existing address reservation of the client, and then add a new reservation. You can change any other information about a reserved client while keeping the reserved IP address.

If you are reserving an IP address for a new client, or an address that is different from its current one, you should verify that the address has not already been leased by the DHCP server. Reserving an IP address in a scope does not automatically force a client currently using that address to stop using it.

If the address is already in use, the client using the address must first release is by issuing a DHCP release message (DHCPRELEASE). To make this happen, at the command prompt of a client computer running Windows 2000 or XOX, type ipconfig /release.

Reserving an IP address at the DHCP server also does not force the new client for which the reservation is made to immediately move to that address. In this case, too, the client must first issue a DHCP request message (DHCPREQUEST). To make this happen, at the command prompt of a client computer running Windows 2000 or XOX, type ipconfig /renew.

For clients using Windows 95 or Windows 98, you can use the Winipcfg.exe program to cause release or renewal of the reserved IP address in DHCP. For clients using MS-DOS, and some clients using other operating systems, a computer must be restarted for the change to take effect.

Once these changes are made, the reserved client is leased the IP address now reserved for its permanent use each time it renews its lease with the DHCP server.

Notes

  • Reserved clients can have DHCP options configured specifically for their use. When options are configured for a reserved client, these values override any option type parameters distributed via server-based, scope-based, or class-based options assignment.
  • You can also use the ipconfig command on computers running earlier versions of Windows NT to release and renew DHCP leases. However, not all other ipconfig command options are available when executed at clients running under these earlier versions.
  • You can create reservations using any IP address in the scope's address range, even if the IP address is also within an exclusion range. Because of this design, when the 80/20 rule is implemented and all addresses in the scope are excluded (80% at one server, 20% at the other), reservations still function properly.


Reconciling scopes

Reconciling scopes can fix inconsistencies, such as incorrect or missing information for client IP addresses that are stored in scope lease information. Scope IP address lease information is stored in two forms by the DHCP Server service:

  • Detailed IP address lease information, stored in the DHCP database.
  • Summary IP address lease information, stored in the DHCP database.

When reconciling scopes, the detail and summary entries are compared to find inconsistencies.

To correct and repair these inconsistencies, you need to reconcile any scope inconsistencies found when performing this operation. Once you select and reconcile scope inconsistencies, the DHCP service either restores those IP addresses to the original owner or creates a temporary reservation for those addresses. These reservations are valid for the lease time assigned to the scope. When the lease time expires, the addresses are recovered for future use.

For more information, see To reconcile the DHCP database or To reconcile a scope.


Setting up options

This section covers:

  • Assigning options
  • Using option classes


Assigning options

You can manage DHCP options at several distinct levels:

  • Predefined options. At this level, you control which types of options are predefined for the DHCP server to expose as available options for assigning from any of the option configuration dialog boxes (such as Server Options, Scope Options, or Reservation Options) available through the DHCP console. You can add or remove options to and from the predefined list of standard options as needed. Although options are made available in this way, they are not assigned values until administratively configured at either the server, scope, or reservation.
  • Server options. Assign values here (using the General tab) for options that should apply to or be inherited by all scopes and clients of the DHCP server as defaults. Options configured here can have their values overridden by different values if those values are set at either a scope, options class, or reserved client level.
  • Scope options. Assign values here (using the General tab) for options that should apply only to clients of an applicable scope selected in the DHCP console tree. Options configured here can have their values overridden by different values if those values are set at either an options class or reserved client level.
  • Reservation options. Assign values for options that should apply only to a specific reserved DHCP client. To use this level of assignment, you must first add a reservation for the applicable client to the applicable DHCP server and scope where the client is to obtain its IP address. These options are set for an individual DHCP client configured with an address reservation in a scope. Only properties manually configured at the client computer can override options assigned at this level.
  • Class options. When using any of the option configuration dialog boxes (Server Options, Scope Options or Reservation Options), you can click the Advanced tab to configure and enable options for assignment to identifying member clients of a specified user or vendor class.

    Depending on the context, only those DHCP clients that identify themselves according to the selected class are distributed options data you have configured specifically for that class. For example, if a class-assigned option is set at a scope, only clients of that scope that indicate class membership during leasing activity are configured with class-assigned option values. Other non-member clients are configured using scope option values set from the General tab.

    Options configured here can override values assigned and set at the same context (either server, scope, or reservation options) or values inherited from options configured at a higher context. However, the ability of the client to indicate membership in a specific options class is typically the decisive criteria for using this level of options assignment. For more information, see Using options classes.

Guidelines for assigning options

The following guidelines can help you determine what level to assign the options you use for clients on your network.

  • Add or define new custom option types only if you have new software or applications that require a nonstandard DHCP option.
  • If your DHCP server manages many scopes for a large network, be selective when assigning Server Options. These options apply by default to all clients of a DHCP server computer, unless otherwise overridden.
  • Use Scope Options for assigning most options that clients use. In most networks, this level is typically preferred for assigning and enabling the use of DHCP options.
  • Use Class Options if you have a mixture of DHCP clients with diverse needs that are able to identify a specific class on the DHCP server when obtaining a lease. For example, if you have a limited number of DHCP client computers running Windows 2000, these clients can be configured to receive vendor-specific options that other clients do not use.
  • Use Reservation Options for individual DHCP clients in your network that have special configuration requirements.

    For any hosts (that is, computers or other networked devices) that do not support DHCP or are not recommended to use it, you can also consider excluding IP addresses for those computers and devices and manually setting the IP address configuration directly at the applicable host. For example, you often need to statically configure the IP address for routers.

Commonly used options

After you set basic TCP/IP configuration settings (such as IP address, subnet mask, and default gateway) for clients, most clients also need the DHCP server to provide other information through DHCP options. The most common of these include the following:

  • Routers. A preferred list of IP addresses for routers on the same subnet as DHCP clients. The client can then contact these routers as needed to forward IP packets destined for remote hosts.
  • DNS servers. IP addresses for DNS name servers that DHCP clients can contact and use to resolve a domain host name query.
  • DNS domain. Specifies the domain name that DHCP clients should use when resolving unqualified names during DNS domain name resolution.
  • WINS node type. A preferred NetBIOS name resolution method for the DHCP client to use (such as b-node for broadcast only or h-node for a hybrid of point-to-point and broadcast methods).
  • WINS server. IP addresses of primary and secondary WINS servers for the DHCP client to use.

Note

  • When the DHCP service is installed, no DHCP option definitions are created. Option definitions are created only when the DHCP console is opened for the first time. If you want to configure the value of an option on a DHCP server on which the console has never been opened, you must first use the Netsh DHCP context command server add optiondef (at a netsh dhcp> command prompt or in a batch file or script) to create the option definition. To use Netsh to assign a value to the option definition you have created, use the Netsh DHCP context command server set optionvalue. For more information, see Netsh commands for DHCP.


Using option classes

Option classes offer an additional method for grouping DHCP-provided configuration details for clients within a scope. For computers running Windows Server 2003 operating systems, there are two types of option classes that can be used for submanaging options:

  • User classes, for assigning options to clients identified as sharing a common need for similar DHCP options configuration.
  • Vendor classes, for assigning vendor-specific options to clients identified as sharing a commonly defined vendor type.

For more information, see Understanding user and vendor classes.

How user classes work

User classes allow DHCP clients to differentiate themselves by specifying a User Class option. When available for client use, this option includes a user-determined class ID that can help to group clients of similar configuration needs within a scope. For example, you might support users and computers with mobile computing needs by configuring a user class at the DHCP server and setting the related class ID at the client computers.

A user class is useful when you need to keep separate options that cover the special needs of identifying client computers, such as providing a shorter lease time for portable computers that move frequently or use remote access often. In this example, you could configure the DHCP server to distribute different options that are specific to the needs of clients.

For instance, shorter leases could be assigned to mobile clients. For more information, see To change the lease time for remote access clients.

The user class feature gives you greater flexibility in configuring DHCP clients on your network, but is not required for standard DHCP use. If user-defined option classes are not configured, options are provided through the applicable server, scope, or client option settings instead. For more information, see Assigning options.

DHCP servers running Windows Server 2003, which support recognition of user class IDs, perform the following added steps to lease clients identifying themselves according to this process:

  1. The server determines whether the user class identified by the client in its lease request is a recognized class, previously defined on the server.

    If a predefined user classes exists at the server and is configured, class-based assignment is enabled. For other user classes, you must first add and configure them at the server before they are available for use.

  2. If the user class is recognized, the server determines whether any additional DHCP options are configured for this class in the active lease context (either the scope or a client reservation) where the server is leasing the client.
  3. If the scope or reservation options are configured to provide options for the user-defined class of the client, the server returns those options to the client as part of its DHCP acknowledgment message (DHCPACK), which is sent to confirm the lease.

Additional user class examples

You can define specific user class identifiers to convey information about client software configuration, its physical location in a building, or about its user preferences. For example, an identifier can specify that DHCP clients are members of a user-defined class called "2nd floor, West," which has need for a special set of router, DNS, and WINS server settings.

You can also use the Microsoft predefined user classes for isolating configuration details specific for clients with special needs, such as BOOTP or Routing and Remote Access service. For more information, see To assign an advanced (class-based) option.

Notes

  • In addition to configuring or adding user classes at the DHCP server, at computers running Windows 2000, or XOX, you can set a DHCP class identifier with the ipconfig /setclassid command. For more information, see To set DHCP class ID information at a client computer.
  • When you configure user classes at the DHCP server, be certain that the class identifying data you set at both the DHCP server and member client computers is identically matching binary or ASCII data. For more information, see To create a new user or vendor class.
  • The user class option only permits one class ID to be used for identifying clients. Each client computer can only be identified as a member of a single user class at the DHCP server. You can use additional user classes and make new hybrids from your other user classes, as needed.

How vendor classes work

Vendor-defined option classes can be used by DHCP clients that are configured to optionally identify themselves by their vendor type to the DHCP server when obtaining a lease. For a client to identify its membership in a vendor class, the client provides a value in the Vendor class identifier option when it requests or selects a lease from the server.

The vendor class identifier information is a string of character data interpreted by a DHCP server. Microsoft supports vendor class identification for its DHCP clients running Windows 98 or XOX.

Most vendor types are derived from standard reserved hardware and operating system type abbreviation codes listed in Request for Comments (RFC) 1700. For more information, see TCP/IP RFCs.

Other vendors might choose to define their own specific vendor class IDs for either conveying vendor-specific information or handling special needs for their DHCP clients.

DHCP servers running Windows Server 2003, which support recognition of vendor class IDs, perform the following additional steps to lease the clients that identify themselves according to this process:

  1. The server determines whether the vendor class identified by the client in its lease request is a recognized class, previously defined on the server.

    Only Microsoft vendor classes are predefined at the server. For other vendor classes, you must manually add and configure these options at your DHCP servers running Windows Server 2003 before they are available for use.

  2. If the vendor class is a recognized one, the server determines whether any additional DHCP options are configured for this class in the active lease context (either the scope or a client reservation) where the server is leasing the client.
  3. If the scope or reservation options are configured to provide options for the vendor-defined class of the client, the server returns them using the Vendor specific information option as part of its DHCP acknowledgment message (DHCPACK), which is sent to confirm the lease.

Vendor classes permit other system vendors to support custom applications for DHCP in mixed vendor environments. Vendor-specific options, when provided, are used in addition to any of the standard DHCP options assigned or required for DHCP.

For more information about DHCP, see "Dynamic Host Configuration Protocol" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/) or refer directly to RFC 2132.

Notes

  • For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)
  • In most cases, the default (or unspecified) vendor class, DHCP standard options, can provide a useful default for grouping any DHCP clients that do not specify or recognize vendor class IDs.
  • When you add new vendor classes at the DHCP server, be sure that the vendor class ID data you set at the server matches the actual vendor class ID used by clients for your vendor. For more information, contact the appropriate vendor.


Interoperability issues

The following section covers issues that affect the use of the DHCP Server service with other services or network configurations.

  • Using DNS servers with DHCP
  • Using Routing and Remote Access servers with DHCP
  • Multihomed DHCP servers


Using DNS servers with DHCP

When installing the Windows Server 2003 DHCP service, you can configure the server to perform updates on behalf of its DHCP clients to any Domain Name System (DNS) servers that support dynamic updates.

How DHCP/DNS update interaction works

The DHCP server can be used to register and update the pointer (PTR) and host (A) resource records on behalf of its DHCP-enabled clients.

This process requires the use of an additional DHCP option, the Client FQDN option (option 81). This option permits the client to provide its fully qualified domain name (FQDN) as well as instructions to the DHCP server on how it would like the server to process DNS dynamic updates (if any) on its behalf.

When this option is issued by a qualified DHCP client, such as a DHCP-enabled computer running Windows 2000, XOX, or a Windows Server 2003 operating system, option 81 is processed and interpreted by a DHCP server running Windows Server 2003 to determine how the server initiates updates on behalf of the client. If the server is configured to perform DNS dynamic updates, it takes one of the following actions:

  • The DHCP server updates both DNS A and PTR records if requested by clients using option 81.
  • The DHCP server updates DNS A and PTR records regardless of whether the client requests this action or not.

In addition, the DHCP server can dynamically update DNS A and PTR records on behalf of legacy clients that are not capable of sending option 81 to the server. You can also configure the DHCP server to discard client A and PTR records when the client lease is deleted.

The DHCP server might be configured in one of the following ways:

  • The DHCP server registers and updates client information with the authoritative DNS server of the zone in which the DHCP server is located according to the DHCP client request.

    This is the default configuration for DHCP servers running Windows Server 2003 and DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system. In this mode, the DHCP client can request the way in which the DHCP server performs updates of its host (A) and pointer (PTR) resource records. If possible, the DHCP server accommodates the client request for handling updates to its name and IP address information in DNS.

    To modify this setting, select the Dynamically update DNS A and PTR records only if requested by the DHCP clients check box, which is located in Properties on the DNS tab on the applicable DHCP server or on one of its scopes.

  • The DHCP server always registers and updates client information in DNS.

    This is a modified configuration supported for DHCP servers running Windows Server 2003 and DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system. In this mode, the DHCP server always performs updates of the client's FQDN, leased IP address information, and both its host (A) and pointer (PTR) resource records, regardless of whether the client has requested to perform its own updates.

    To modify this setting, select the Enable DNS dynamic updates according to the settings below check box and click Always dynamically update DNS A and PTR records, which is located in Properties on the DNS tab on the applicable DHCP server or on one of its scopes.

  • The DHCP server never registers and updates client information in DNS.

    To set this behavior, the DHCP server must be configured to disable performance of DHCP/DNS proxied updates. By disabling this feature, no client host (A) or pointer (PTR) resource records are updated in DNS for DHCP clients.

    If necessary, this change in setting can be made at DHCP servers running Windows Server 2003 by clearing the Enable DNS dynamic updates according to the settings below check box, which is located in Properties on the DNS tab on the applicable DHCP server or one of its scopes. By default, updates are always performed for newly installed DHCP servers running Windows Server 2003 and any new scopes created for them.

Advanced DHCP/DNS server configuration options

In addition to these standard DHCP/DNS interactions, the DHCP server can be configured to perform these optional update tasks as follows:

  1. The server can selectively be configured to not send updates for discarding a client host (A) resource record when the client lease expires.

    When the DHCP server is enabled to perform DNS updates, it always sends updates to discard the client pointer (PTR) resource records when the lease expires. Whether the server also does this with client host (A) resource records when the lease of a client expires (by default, the server discards these) is a configurable option.

    To modify this at the applicable DHCP server, clear the Discard forward (name-to-address) lookups when leases expires check box in Properties on the DNS tab.

  2. The server can be selectively configured to not send updates for clients unable to use the Client FQDN option (option 81), to request the way that updates are handled.

    By default, the DHCP server does not send updates for clients that do not support option 81.

    To modify this setting, select the Dynamically update DNS A and PTR records for DHCP clients that do not request updates (for example, clients running Windows NT 4.0) check box, which is located in Properties on the DNS tab on the applicable DHCP server or one of its scopes.

Windows DHCP clients and DNS dynamic update protocol

DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system interact differently than earlier versions of Windows when performing the DHCP/DNS interactions previously described. The following examples and graphics show how this process varies in different cases.

Example 1: DHCP/DNS update interaction for DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system

DHCP clients running Windows 2000, XOX, or a Windows Server 2003 operating system interact with DNS dynamic update protocol as follows:

  1. The client initiates a DHCP request message (DHCPREQUEST) to the server and includes DHCP option 81. By default, the client requests that the DHCP server register the DNS PTR record, while the client registers its own DNS A record.
  2. The server returns a DHCP acknowledgment message (DHCPACK) to the client, granting an IP address lease and including DHCP option 81. If the DHCP server is configured with the default settings (dynamically update DNS A and PTR records only if requested by the DHCP clients), then option 81 instructs the client that the DHCP server will register the DNS PTR record and the client will register the DNS A record.
  3. Asynchronously, the client registers its DNS A record, and the DHCP server registers the DNS PTR record of the client.
Example 1: DHCP/DNS update interaction for DHCP clients

Example 2: DHCP/DNS update interaction for earlier Windows DHCP clients (prior to Windows 2000)

Earlier versions of Windows DHCP clients do not support the DNS dynamic update process directly, and therefore, cannot directly interact with the DNS server. For these DHCP clients, updates are typically handled as follows:

  1. The client initiates a DHCP request message (DHCPREQUEST) to the server. The request does not include DHCP option 81.
  2. The server returns a DHCP acknowledgment message (DHCPACK) to the client, granting an IP address lease, without DHCP option 81.
  3. The server then sends updates to the DNS server for the forward lookup record of the client, which is a host (A) resource record. The server also sends updates for the reverse lookup record of the client, which is a pointer (PTR) resource record.
Example 2: DHCP/DNS update interaction for Windows NT 4.0 and earlier DHCP clients.

DNS record ownership and the DnsUpdateProxy group

As previously described, you can configure a DHCP server so that it dynamically registers host (A) and pointer (PTR) resource records on behalf of DHCP clients. In this configuration, the use of secure dynamic update with DNS servers might cause stale resource records.

For example, suppose the following sequence of events occurs:

  1. A DHCP server running Windows Server 2003 (DHCP1) performs a secure dynamic update on behalf of one of its clients for a specific DNS domain name.
  2. Because the DHCP server successfully created the name, it becomes the owner of the name.
  3. Once the DHCP server becomes the owner of the name, only that DHCP server can update the DNS records for that name.

In some circumstances, this can cause problems. For example, if DHCP1 fails and a second backup DHCP server comes online, the second server cannot update the client name because it is not the owner of the name.

In another example, if the DHCP server performs DNS dynamic updates for legacy DHCP clients (clients running a version of Windows earlier than Windows 2000), and those clients are later upgraded to Windows 2000, XOX, or a Windows Server 2003 operating system, the upgraded client cannot take ownership of or update its own DNS records.

To solve this problem, the built-in security group called DnsUpdateProxy is provided. If all DHCP servers are added as members of the DnsUpdateProxy group, then the records of one server can be updated by another server if the first server fails. Also, because all of the objects that are created by the members of the DnsUpdateProxy group are not secured, the first user (that is not a member of the DnsUpdateProxy group) to modify the set of records that is associated with a DNS name becomes its owner. When legacy clients are upgraded, they can therefore take ownership of their name records at the DNS server. If every DHCP server registering resource records for legacy clients is a member of the DnsUpdateProxy group, the problems discussed earlier are eliminated.

You can configure the DnsUpdateProxy security group through Active Directory Users and Computers. For more information, see To add a member to a group.

Securing records when using the DnsUpdateProxy group

DNS domain names that are registered by the DHCP server are not secure when the DHCP server is a member of the DnsUpdateProxy group. The host (A) resource record for the DHCP server itself is an example of such a record. Also, because objects created by the members of the DnsUpdateProxy group are not secured, it is impossible to use this group effectively in an Active Directory integrated zone that allows only secure dynamic updates unless you take additional steps to allow records created by members of the group to be secured.

To protect against unsecured records, or to allow members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you can create a dedicated user account and configure DHCP servers to perform DNS dynamic updates with the user account credentials (user name, password, and domain). The credentials of one dedicated user account can be used by multiple DHCP servers.

A dedicated user account is a user account whose sole purpose is supplying DHCP servers with credentials for DNS dynamic update registrations. When you create a dedicated user account and configure DHCP servers with the account credentials, each DHCP server supplies these credentials when registering names on behalf of DHCP clients using DNS dynamic update. The dedicated user account should be created in the forest where the primary DNS server for the zone to be updated resides. The dedicated user account can also be located in another forest as long as the forest it resides in has a forest trust established with the forest containing the primary DNS server for the zone to be updated. For more information about establishing forest trusts, see Forest Trusts.

When the DHCP Server service is installed on a domain controller, configuring the DHCP server with the credentials of the dedicated user account will prevent the server from inheriting, and possibly misusing, the power of the domain controller. When installed on a domain controller, the DHCP Server service inherits the security permissions of the domain controller and has the authority to update or delete any DNS record that is registered in a secure Active Directory-integrated zone (this includes records that were securely registered by other computers running Windows 2000 or a Windows Server 2003 operating system, including domain controllers).

It is necessary to configure a dedicated user account and configure the DHCP server with the account credentials under the following circumstances:

  • A domain controller is configured to function as a DHCP server.
  • The DHCP server is configured to perform DNS dynamic updates on behalf of DHCP clients.
  • The DNS zones to be updated by the DHCP server are configured to allow only secure dynamic updates.

Once you have created a dedicated user account, you can configure DHCP servers with the user account credentials by using the DHCP console or by using the Netsh DHCP context command server set dnscredentials. For more information on configuring credentials using the DHCP console, see To configure DNS dynamic update credentials. For a comprehensive reference about Netsh commands for DHCP (including syntax, parameters, and examples for the set dnscredentials command at the server context of netsh dhcp), see Netsh commands for DHCP.

For more information on groups and accounts, see To create a new user account and Default groups.

Additional resources on DHCP and DNS interaction

Because of the close integration of DHCP and DNS described in this section, you might want to investigate or review these additional topics as resources for your deployment issues related to this feature.

For more information:

  • On the DNS dynamic update protocol and considerations for securing dynamic updates when using Active Directory, see Dynamic update.
  • On how to configure DNS servers to enable some or all updates for specific zones, see To allow dynamic updates and To allow only secure dynamic updates.
  • On how to enable DHCP servers to initiate updates on behalf of its clients for specific scopes (or all scopes), see To enable DNS dynamic updates for clients.
  • On how you can modify or set computers to initiate dynamic updates on their own behalf, see To configure TCP/IP to use DNS.
  • On DNS resource records, see DNS or Resource records reference.

Notes

  • Microsoft supports the DHCP/DNS update interaction currently under final review as a proposed Internet standard Request for Comment (RFC) document by the Internet Engineering Task Force (IETF).

    This interactive process is fully described in the applicable draft, "Interaction between DHCP and DNS." To obtain the current or final version of this draft, see the Request for Comments Web site.

  • If you are using legacy DNS servers that do not support dynamic updates, you can implement the following changes for dynamically updating and registering names and addresses for your DHCP clients:
    1. If you are using WINS and legacy Windows DNS servers (that is, DNS servers running Windows NT Server 4.0), you might be able to use WINS lookup integration to support resolution of client names and addresses on your network that are not updated dynamically in DNS.
    2. Upgrade or replace older DNS servers with DNS servers running Windows Server 2003.
  • For more information about DHCP, see "Dynamic Host Configuration Protocol" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)
  • XOX


Using Routing and Remote Access servers with DHCP

The DHCP Server service can be deployed along with the Routing and Remote Access service to provide remote access clients with a dynamically assigned IP address during connection. When these services are used together on the same server computer, the information provided during dynamic configuration is provided differently than in the case of typical DHCP configuration for LAN-based clients.

In LAN environments, DHCP clients negotiate and receive the following configuration information, based entirely on settings configured in the DHCP console for the DHCP server:

  • A leased IP address provided from the available address pool of an active scope on the DHCP server. The DHCP server directly manages and distributes the address to the LAN-based DHCP client.
  • Additional parameters and other configuration information provided through assigned DHCP options in the address lease. The values and list of options used correspond to option types configured and assigned on the DHCP server.

When a Routing and Remote Access server provides dynamic configuration for dial-up clients, it first performs the following steps:

  • When the Routing and Remote Access server starts with the Use DHCP to assign remote TCP/IP addresses option, it instructs the DHCP client to obtain 10 IP addresses from a DHCP server.
  • The remote access server utilizes the first of these 10 IP addresses obtained from the DHCP server for the remote access server interface.
  • The remaining nine addresses are allocated to TCP/IP-based clients as they dial in to establish a session with the remote access server.

IP addresses that are freed when remote access clients disconnect are reused. When all 10 IP addresses are used, the remote access server obtains 10 more from a DHCP server. When the Routing and Remote Access service is stopped, all IP addresses obtained through DHCP are released.

When the Routing and Remote Access server uses this type of proactive caching of DHCP address leases for dial-up clients, it records the following information for each lease response it obtains from the DHCP server:

  • The IP address of the DHCP server
  • The client leased IP address (for later distribution to the Routing and Remote Access client)
  • The time at which the lease was obtained
  • The time at which the lease expires
  • The duration of the lease

All other DHCP option information returned by the DHCP server (such as server, scope, or reservation options) is discarded. When the client dials in to the server and requests an IP address (that is, when Server Assigned IP Address is selected), it uses a cached DHCP lease to provide the dial-up client with dynamic IP address configuration.

When the IP address is provided to the dial-up client, the client is unaware that the IP address has been obtained through this intermediate process between the DHCP server and the Routing and Remote Access server. The Routing and Remote Access server maintains the lease on behalf of the client. Therefore, the only information that the client receives from the DHCP server is the IP address lease.

In dial-up environments, DHCP clients negotiate and receive dynamic configuration using the following modified behavior:

  • A leased IP address from the Routing and Remote Access server cache of DHCP scope addresses. The Routing and Remote Access server obtains and renews its cached address pool with the DHCP server.
  • If additional parameters and other configuration information provided through assigned DHCP options in the address lease is normally provided by the DHCP server, this information is returned to the Routing and Remote Access client based on TCP/IP properties configured on the Routing and Remote Access server.

Note

  • DHCP servers running Windows Server 2003 provide a predefined user class, the Default Routing and Remote Access Class, for assigning options that are specific and provided only to Routing and Remote Access clients.


Multihomed DHCP servers

A multihomed DHCP server is a computer running a Windows Server 2003 operating system that uses the DHCP service for more than a single network connection. For a server computer to be multihomed, each network connection must attach the computer to more than a single physical network. This requires that additional hardware (in the form of multiple installed network adapters) be used on the computer.

A computer running a Windows Server 2003 operating system can perform as a multihomed DHCP server. For multihomed servers, the DHCP service binds to the first IP address statically configured for each network connection in use.

By default, the service bindings depend on whether the first network connection is configured dynamically or statically for TCP/IP. Based on the method of configuration it uses, reflected by its current settings in Internet Protocol (TCP/IP) properties, the DHCP Server service performs default service bindings as follows:

  • If the first network connection uses a manually specified IP address, the connection is enabled in server bindings. For this to occur, a value for IP address must be configured and the Use the following IP address option selected in Internet Protocol (TCP/IP) properties. In this mode, the DHCP server listens for and provides service to DHCP clients.
  • If the first network connection uses an IP address configured dynamically, the connection is disabled in server bindings. This occurs when the Obtain an IP address automatically option is selected in Internet Protocol (TCP/IP) properties. For computers running Windows Server 2003 operating systems, this is the default setting. In this mode, the DHCP server does not listen for and provide service to DHCP clients until a static IP address is configured.
  • The DHCP server will bind to the first static IP address configured on each adapter.

Notes

  • By design, DHCP server bindings are enabled and disabled on a per-connection, not per-address basis. All bindings are based on the first configured IP address for each connection appearing in the Network Connections folder. If additional static IP addresses (for example, as set in Advanced TCP/IP properties) are configured for the applicable connection, these addresses are never used by DHCP servers running Windows Server 2003 and are inconsequential for server bindings.
  • For more information, see About Network Connections.
  • DHCP servers running Windows Server 2003 never bind to any of the NDISWAN or DHCP-enabled interfaces used on the server. These interfaces are not displayed in the DHCP console under the current server bindings list because they are never used for DHCP service. Only additional network connections that have a primary static IP address configured can appear in the server bindings list (or be selectively enabled or disabled there).
  • For more information, see To selectively set DHCP server bindings for network connections.

Example: Configuring a multihomed DHCP server

The following illustration is an example of a multihomed DHCP server with three network adapters installed. Each adapter is configured to lease addresses on separate physical subnets.

Example: multihomed DHCP server

Note that in the graphic, each network adapter is configured statically with a single IP address. In this network example, three Class C ranges of IP addresses are used:

Subnet | IP Address Range
Subnet A | 192.168.0.1 - 192.168.0.254
Subnet B | 192.168.1.1 - 192.168.1.254
Subnet C | 192.168.2.1 - 192.168.2.254

Each of the three adapters in this example connects the server to three different physical subnets (Subnets A, B, and C). To achieve the intended result of having DHCP provide leased configuration service to all clients in each of the respective subnets, two configuration details are essential and must be verified during deployment plans:

  1. The server must use a statically configured IP address on the same subnet as the IP address range it services.
  2. The server must have each of its valid subnet IP addresses excluded from the scope used to offer leases to clients.

The default subnet mask value (255.255.255.0) is used for all three subnets, providing 254 IP addresses available per subnet for lease to DHCP clients.

To provide a small pool of ten IP addresses available for statically configured devices such as the DHCP server, printers, and other devices, an exclusion range is created in the scope for each subnet:

Subnet | Exclusion Range
Subnet A | 192.168.0.1 - 192.168.0.10
Subnet B | 192.168.1.1 - 192.168.1.10
Subnet C | 192.168.2.1 - 192.168.2.10

Exclusion ranges prevent the DHCP server from assigning IP addresses to DHCP clients, so all of the IP addresses contained in the exclusion ranges will remain available for static configurations even after the DHCP server is started and begins servicing clients.

Addresses that are not excluded remain available for assignment to DHCP clients. These ranges of IP addresses form each subnet's address pool:

Subnet | Address Pool
Subnet A | 192.168.0.11 - 192.168.0.254
Subnet B | 192.168.1.11 - 192.168.1.254
Subnet C | 192.168.2.11 - 192.168.2.254

Note

  • For more information on IP subnetting, see Subnet masks or the Microsoft Windows Server 2003 Resource Kit.


Resources

This section covers:

  • DHCP updated technical information
  • DHCP console icons reference


DHCP updated technical information

Updated technical information for DHCP can be obtained by searching technical articles available from the Personal Support Center at the Microsoft Web site. For more information, see Updated technical information.

You can also obtain additional in-depth information on DHCP in the Microsoft Windows Server 2003 Resource Kit.

For more information about DHCP, see "Dynamic Host Configuration Protocol" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


DHCP console icons reference

DHCP provides context-specific icons to dynamically represent the state of console objects. Objects include the DHCP servers, clients, scopes, and option types that are used and managed for each server.

General usage of console icons

Some of the icons used in DHCP have specific meanings, but most are used to communicate general status information about the current state of the console. For example, when an icon is used with an hourglass superimposed, such as:

DHCP server busy

it means that the console is attempting to connect to the server.

Likewise, when an icon is used with a red circle and a superimposed 'X', such as:

DHCP server not connected

it often means that DHCP has lost its connection to the server.

Glossary of specific icons

The following is a partial list of console icons used in DHCP.

You can expand a specific group of console items by clicking the appropriate link or by clicking expand all items to expand all groups in the icon reference.

Server-related icons

Icon | Description
DHCP server added | DHCP server added to console.
DHCP server connected (active) | DHCP server connected and active in console.
DHCP server connected (inactive) | DHCP server connected but not authorized in Active Directory for use on your network.
DHCP server Not Loaded | DHCP server connected but current user does not have the administrative credentials to manage the server.
DHCP server Warning | DHCP server warning. Available addresses for server scopes are 90 percent or more leased and in use. This means that the server is nearly depleted of available addresses to lease to clients.
DHCP server Alert | DHCP server alert. No addresses are available from server scopes because the maximum (100 percent) of the addresses allocated for use are currently leased. This represents a failure of the DHCP server on the network because it is not able to lease or service clients.

Scope-related icons

Icon | Description
Scope or Superscope Active | Scope or superscope is active.
Scope or superscope is inactive. | Scope or superscope is inactive.
Scope Warning | Scope or superscope warning. Scope warning: 90 percent or more of the scope's IP addresses are in use. Superscope warning: If any scope within the superscope has a warning, the superscope has a warning.
Scope Alert | Scope or superscope alert. Scope alert: All IP addresses have been allocated by the DHCP server and are in use. No more clients can obtain IP addresses from the DHCP server because it has no more IP addresses to allocate. Superscope alert: At least one scope contained in the superscope has all IP addresses allocated by the DHCP server. No clients can obtain an IP address from the range defined in the scope that is 100 percent allocated. If other scopes within the superscope contain available addresses, the DHCP server can allocate addresses from these scopes.

Option-related icons

Icon | Description
Server options folder | Server options folder.
Server option | Server option.
Scope options folder | Scope options folder.
Scope option | Scope option.
Reservation option | Reservation option.

Other console icons

Icon | Description
DHCP | Root of the DHCP console.
Address pool folder | Address pool folder.
Scope allocation range | Scope allocation range. Addresses in this range are allocated to the available address pool used to offer leases to clients.
Scope exclusion range | Scope exclusion range. Addresses in this range are excluded from the available address pool used to offer leases to clients.
Active leases folder | Active leases folder.
Client, LAN-based | Active lease: this address is not available for lease by the DHCP server.
Client not registered. | Expired lease: this address is available for lease by the DHCP server.
Client active and registered. | Active lease, DNS dynamic update pending. This address is not available for lease by the DHCP server.
Client using remote access | Client is using dial-up network connection through a remote access server.
Reservations folder | An individual reservation and the reservations folder.
BOOTP table | Bootstrap Protocol (BOOTP) table.
BOOTP entry in table | BOOTP entry in the table.


Troubleshooting

  • Troubleshooting DHCP clients
  • Troubleshooting DHCP servers


Troubleshooting DHCP clients

What problem are you having?

The DHCP client does not have an IP address configured or indicates that its IP address is 0.0.0.0.

Cause: The client was not able to contact a DHCP server and obtain an IP address lease, either because of a network hardware failure or because the DHCP server is unavailable.

Solution: Verify that the client computer has a valid functioning network connection. First, check that related client hardware (cables and network adapters) are working properly at the client using basic network and hardware troubleshooting steps.

If the client hardware appears to be prepared and functioning properly, check that the DHCP server is available on the network by pinging it from another computer on the same network as the affected DHCP client.

See also: The Hardware troubleshooter in the List of troubleshooters

The DHCP client appears to have automatically assigned itself an IP address that is incorrect for the current network.

Cause: The client running Windows 98, Windows Millennium Edition, or XOX could not find a DHCP server and has used IP autoconfiguration to configure its IP address.

In some larger networks, disabling IP autoconfiguration might be desirable for network administration.

Solution: First, use the ping command to test connectivity from the client to the server. Your next step would be to either verify or manually attempt to renew the client lease. Depending on your network requirements, it might be necessary to disable IP autoconfiguration at the client. You can learn more about IP autoconfiguration and how it works prior to making this decision.

See also: To test a TCP/IP configuration by using the ping command; To verify, release, or renew a client address lease; To configure TCP/IP for automatic addressing; To disable automatic address configuration

The DHCP client appears to be missing some network configuration details or is unable to perform related tasks, such as resolving names.

Cause: The client might be missing DHCP options in its leased configuration, either because the DHCP server is not configured to distribute them or the client does not support the options distributed by the server.

Solution: For Microsoft DHCP clients, verify that the most commonly used and supported options have been configured at the server, scope, client, or class level of options assignment.

See also: Manage options and classes; Assigning options

The DHCP client appears to have incorrect or incomplete options, such as an incorrect or missing router (default gateway) configured for the subnet on which it is located.

Cause: The client has the full and correct set of DHCP options assigned but its network configuration does not appear to be working correctly.

If the DHCP server is configured with an incorrect DHCP router option (option code 3) for the default gateway address of the client, clients running Windows NT, Windows 2000, or XOX use the correct address. However, DHCP clients running Windows 95 use the incorrect address.

Solution: Change the IP address list for the router (default gateway) option at the applicable DHCP scope and server. If you are configuring the router option as a Server Option at the affected DHCP server, remove it there and set the correct value in the Scope Options node for the applicable DHCP scope that services the client.

In rare instances, you might have to configure the DHCP client to use a specialized list of routers different from other scope clients. In such cases, you can add a reservation and configure the router option list specifically for the reserved client.

See also: To assign a server-based option; To assign a scope-based option; To assign an option to a reserved client; To add a client reservation; Assigning options

For more information about DHCP options, see "DHCP Options" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Many DHCP clients are unable to get IP addresses from the DHCP server.

Cause: The IP address of the DHCP server was changed and now DHCP clients cannot get IP addresses.

Solution: A DHCP server can only service requests for a scope that has a network ID that is the same as the network ID of its IP address.

Make sure that the DHCP server IP address falls in the same network range as the scope it is servicing. For example, a server with an IP address in the 192.168.0.0 network cannot assign addresses from scope 10.0.0.0 unless superscopes are used.

See also: Best practices; Using superscopes; Configuring scopes

Cause: The DHCP clients are located across a router from the subnet where the DHCP server resides and are unable to receive an address from the server.

Solution: A DHCP server can provide IP addresses to client computers on remote multiple subnets only if the router that separates them can act as a DHCP relay agent.

Completing the following steps might correct this problem:

  1. Configure a BOOTP/DHCP Relay Agent on the client subnet (that is, the same physical network segment). The relay agent can be located on the router itself, on a computer running Windows NT Server and the DHCP Relay Agent component, on a computer running Windows 2000 Server with the Routing and Remote Access service enabled and configured as a DHCP Relay Agent, or on a computer running a Windows Server 2003 operating system with the Routing and Remote Access service enabled and configured as a DHCP Relay Agent.
  2. At the DHCP server, do the following:
    1. Configure a scope to match the network address on the other side of the router where the affected clients are located.
    2. In the scope, make sure that the subnet mask is correct for the remote subnet.
    3. Use a default gateway on the network connection of the DHCP server in such a way that it is not using the same IP address as the router that supports the remote subnet where the clients are located.
    4. Do not include this scope (that is, the one for the remote subnet) in superscopes configured for use on the same local subnet or segment where the DHCP server resides.
  3. Make sure there is only one logical route between the DHCP server and the remote subnet clients.

See also: Best practices; DHCP/BOOTP relay agents; BOOTP and DHCP

Cause: Multiple DHCP servers exist on the same local area network (LAN).

Solution: Make sure that you do not configure multiple DHCP servers on the same LAN with overlapping scopes.

You might want to rule out the possibility that one of the DHCP servers in question is a Small Business Server (SBS) computer. By design, the DHCP Server service, when running under SBS, automatically stops when it detects another DHCP server on the LAN.

See also: Best practices; Configuring scopes

The DHCP client appears to be affected by another problem not described above.

Cause: My problem is not described above.

Solution: Search the Microsoft Web site for updated technical information that might relate to the problem you have observed. If necessary, you can obtain information and instructions that pertain to your current problem or issue.

If you are connected to the Internet, the latest updates for the Windows Server 2003 family are available at the Microsoft Web site. (http://www.microsoft.com/)

See also: DHCP updated technical information; DHCP; Microsoft Windows Deployment and Resource Kits; Microsoft Web site (http://www.microsoft.com/)


Troubleshooting DHCP servers

What problem are you having?

The DHCP server is stopped.

Cause: The DHCP server has not been authorized to operate on the network.

Solution: Authorize the DHCP server in the enterprise where it is being used.

See also: Authorizing DHCP servers; To authorize a DHCP server in Active Directory; To delegate ability to authorize servers to a non-enterprise administrator

Cause: Configuration details might be incorrect or missing at the server.

Solution: If you have just completed setting up or administering the DHCP server, you might want to review the provided checklist to see if you have missed a crucial step in the installation process.

To help prevent the most common types of problems, review DHCP best practices for tips on deploying and managing your servers.

Because many DHCP failures are first detected as client-side errors, you might want to start by investigating the problem there.

See also: Checklist: Installing a DHCP server; Best practices; Troubleshooting DHCP clients

Cause: The DHCP server has been stopped.

Solution: Check the system event log and DHCP server audit log files for details.

When the DHCP Server service either stops or cannot start, useful explanatory information about the source of the service failure or shutdown can generally be found in these logs.

See also: Audit logging; Analyzing server log files; Using Event Viewer; To search for specific events

The DHCP server is unable to provide service to clients.

Cause: The server is a multihomed computer and is not providing service on one or more of its network connections.

Solution: Review Windows Server 2003 DHCP binding defaults for network connections based on whether you have elected to either statically or dynamically configure TCP/IP for any or all installed connections on the server computer. Also, review an example of multihomed DHCP server configuration to see if you have missed any critical details.

See also: Multihomed DHCP servers; To selectively set DHCP server bindings for network connections

Cause: Scopes or superscopes on the DHCP server have not been either configured or activated for use.

Solution: Add scopes and make sure that they are correctly configured along with any DHCP scope options that need to be assigned for client use.

See also: Configuring scopes; To create a new scope; To assign a scope-based option

Cause: The server is located on a different subnet as some of its clients and is not providing service to clients on remote subnets.

Solution: If you are using a DHCP server in a routed network, you might want to review issues related to DHCP relay agents and the appropriate use of superscopes.

See also: DHCP/BOOTP relay agents; Using superscopes; To create a superscope

Cause: The scope in use is full and can no longer lease addresses to requesting clients.

Solution: If the DHCP server does not have IP addresses available to provide to its clients, it returns DHCP negative acknowledgment messages (DHCPNAKs) to them. When this occurs, consider the following possible solutions:

  1. Expand the address range by increasing the End IP address for the current scope.
  2. Create a new additional scope and a superscope, then add the current scope and the new scope to the superscope.
  3. Create a new scope or extend the range. Optimally, you could renumber your current IP network. Deactivate the old scope as needed, and then configure and activate the new one.
  4. Reduce the lease duration. This can help to expedite the reclaiming of lapsed scope addresses.

Other DHCP-related procedures and techniques might also help to accelerate or ease the transition from an existing scope being retired to a new scope created to take its place at the server. These include deleting client leases from the scope being retired, excluding addresses from that scope, and then deactivating it once the new scope has been activated. This ensures that the DHCP client obtains leasing from the new scope.

See also: Managing leases; Removing scopes; To delete a client lease; To exclude an address from a scope; To activate a scope; To deactivate a scope

Cause: The range of IP addresses being offered by the DHCP server is in conflict with the range of addresses being offered by another DHCP server on the network.

You can confirm that this is the likely cause if DHCP server logs still indicate that DHCP negative acknowledgment messages (DHCPNAKs) are being returned to requesting clients or if you have tried unsuccessfully at the client to renew its lease manually.

Solution: Modify the scope address pool for the scopes at each DHCP server to ensure that scope IP addresses do not overlap. You can add exclusions to the scopes as necessary, delete client leases, and temporarily enable server-side conflict detection to assist in solving the problem.

See also: To delete a client lease; To exclude an address from a scope; To enable address conflict detection; Best practices

One of two DHCP servers on the same subnet is not servicing clients.

Cause: The DHCP server is not authorized in Active Directory.

Solution: If the DHCP server is a domain member, authorize the server in Active Directory.

In some circumstances you might accidentally have a standalone server and a domain member server on the same subnet. When the standalone server detects the domain member server, it attempts to verify that it is authorized in Active Directory. Even if a domain controller resides on the same subnet as the standalone DHCP server, the DHCP server cannot verify its status with the domain controller because the DHCP server is not a domain member. When the standalone server is unable to access a domain controller to discover whether it is authorized, it stops servicing clients and displays the red icon in the DHCP console that indicates the server is unauthorized. If you want the standalone server to service clients on the subnet, remove the authorized DHCP server from the subnet.

See also: Authorizing DHCP servers; To authorize a DHCP server in Active Directory; DHCP console icons reference

The DHCP server appears to have suffered some data corruption or loss.

Cause: The DHCP server database has become corrupted or is missing server data, possibly reporting JET database errors.

Solution: Use DHCP server data recovery options to restore the database and correct any of the reported errors. You can also use the Reconcile feature in the DHCP console to verify and reconcile any database inconsistencies that the server is able to find.

See also: Restoring server data; The DHCP database; Reconciling scopes; To reconcile the DHCP database; To reconcile a scope

The server appears to be affected by another problem not described above.

Cause: My problem is not described above.

Solution: Search the Microsoft Web site for updated technical information that might relate to the problem you have observed. You can obtain information and instructions that pertain to your current problem or issue.

If you have connection to the Internet, the latest updates for members of the Windows Server 2003 family are available at the Microsoft Web site. (http://www.microsoft.com/)

See also: DHCP updated technical information; DHCP; Microsoft Windows Server 2003 Resource Kit; Microsoft Web site (http://www.microsoft.com/)