Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
DHCP in Active Directory
The Dynamic Host Configuration Protocol (DHCP) allows a client to receive an IP address automatically from the DHCP server. This process avoids configuration errors caused by configuring each computer manually. DHCP helps prevent address conflicts that occur when an identical IP address is reused to configure a new computer on the network. In the case of users with portable computers who change locations frequently (and subsequently need updated client configurations), the DHCP lease renewal process helps ensure efficient and automatic updates.
Active Directory requires a DHCP server to be authorized before it can respond to client requests. If you happened to upgrade a Windows NT 4.0 DHCP server to a Windows 2000 domain controller, and the server's DHCP service isn't working, make sure the server is authorized.
To authorize the DHCP server for Active Directory, perform the following steps:
-
Select Start, Programs, Administrative Tools, DHCP.
-
In the console, right-click DHCP and select Manage Authorize Servers.
-
Click Authorize in the Manage Authorized Servers window.
-
Enter the name or IP address of the DHCP server to be authorized, and click OK.
To enable DHCP, a client must have the Obtain an IP Address Automatically radio button selected in the TCP/IP Properties property sheet (see Figure 3.9), which is accessible through the Local Area Connection icon in Windows 2000 clients, or the Network Neighborhood in Windows 9x and NT. This option is enabled by default when the client is initially installed, so if you are using DHCP, you do not need to manually set your IP configuration.
){kind=link}
Figure
3.9
Setting a Windows 2000 client for DHCP.
Benefits
Here are some of the benefits of using DHCP:
-
You don't need to manually change the IP settings for a mobile client that moves between different sites of your network because the client automatically receives a new IP address as long as a DHCP server is available on the new subnet.
-
You don't need to manually configure settings for DNS or WINS. The DHCP server assigns these settings when you enable this option on the client by selecting the Obtain DNS Server Address Automatically option button.
-
You can avoid duplicate IP addresses conflicts and reduce network administration and manual entry errors by centrally defining global and subnet-specific TCP/IP configurations.
-
Because most routers can forward DHCP configuration requests, you can eliminate the need to set up a DHCP server on every subnet.
New Windows 2000 DHCP Features
The Windows 2000 DHCP service provides the following new features:
-
Enhanced graphical server performance monitoring and reporting capabilities.
-
DHCP with DNS integration, which allows a DHCP server to perform dynamic updates in DNS for DHCP clients supporting dynamic updates.
-
Prevention of unauthorized DHCP servers from joining a DHCP network. Active Directory is queried when an unauthorized DHCP server is added to the network, and the server's IP address is compared to the list of authorized DHCP servers. If it is not on the list, its DHCP service is automatically shut down.
-
Restricted access to the DHCP Manager console, which adds security to DHCP deployments by providing a special-purpose local group (the DHCP Users group) that can view, but not modify, information on the specified DHCP server. This user group is automatically added when the DHCP service is installed.
DHCP Lease Process
The process consists of four basic steps:
-
DHCP Discover
-
DHCP Offer
-
DHCP Request
-
DHCP Acknowledge
In the Discover phase, the DHCP client asks for an IP address. In the Offer phase, the client is offered an address from the local DHCP server. In the Request phase, the client accepts the offer and requests the IP address. In the Acknowledge phase, the client is officially assigned the address. Figure 3.10 illustrates this process.
){kind=link}
Figure
3.10
The DHCP reservation process.
After the client is configured, the DHCP server places a lease time on the address, which is based on the lease time setting in the DHCP options window (this value is set in seconds). Halfway through the lease period, the DHCP client requests a lease renewal, and the DHCP server extends the lease. This means that when a machine stops using its assigned IP address, the lease expires and the address is returned to the pool for reassignment. This occurs if a mobile computer leaves the network.
The four steps necessary for a DHCP client to acquire a lease from a DHCP server are initiated automatically when the computer is first booted. The following host systems can act as DHCP clients:
-
Windows NT Workstation (3.5 through Windows 2000)
-
Windows NT Server (3.5 through Windows 2000)
-
Windows 9x computers
-
Windows for Workgroups version 3.11 (with the Microsoft 32-bit TCP/IP VxD installed)
-
Microsoft Network Client version 3.0 for the Microsoft MS-DOS operating system (with the real-mode TCP/IP driver installed)
-
LAN Manager version 2.2c
-
UNIX workstations
-
Macintosh computers
-
Network printers and print servers
Integration of DHCP with Dynamic DNS
Windows 2000 DNS interacts with the DHCP service, allowing servers and DHCP clients to maintain synchronized name-to-IP mappings.
Windows 2000 DHCP clients and earlier versions of Windows DHCP clients interact with DNS in different ways. The DHCP server can be configured to register the DHCP client always for both the forward (A-type records) and reverse (PTR-type records) lookups with DNS. Windows 2000 DHCP clients update their own dynamic forward lookup names.
Figure 3.11 shows how Windows 2000 DHCP clients interact with dynamic updates.
){kind=link}
Figure
3.11
Windows 2000 DHCP clients and dynamic update.
-
The Windows 2000 DHCP client makes an IP lease request.
-
The DHCP server grants an IP lease.
-
The Windows 2000 DHCP client updates its forward (A) record with the DNS server.
-
The DHCP server updates the DNS reverse (PTR) record for the client using the dynamic update protocol.
Earlier versions of Windows DHCP clients do not interact directly with DNS servers that perform dynamic updates. Figure 3.12 shows how the forward and reverse lookup names are updated by a DHCP server if the service has been configured for this.
){kind=link}
Figure
3.12
Older DHCP clients and dynamic updates.
-
The DHCP client makes an IP lease request.
-
The DHCP server grants an IP lease.
-
The DHCP server automatically generates the client's FQDN by appending the domain name defined for the scope to the client name obtained from the DHCPRequest message sent by the older client.
-
Using the dynamic update protocol, the DHCP server updates the DNS forward (A) record for the client.
-
Using the dynamic update protocol, the DHCP server updates the DNS reverse (PTR) record for the client.
Configuring DHCP
You can define server- and scope-specific configuration settings to identify routers and set DHCP client configurations.
DHCP Scopes
A DHCP scope identifies the possible IP addresses for DHCP clients on a specific subnet. Scopes define a range in which DHCP services are to be offered and allow the server to identify configuration parameters (such as DNS and WINS information if necessary) provided to DHCP clients. A scope must be defined before DHCP clients can acquire an IP address.
To configure a DHCP server scope, perform the following steps:
-
In the DCHP snap-in, right-click the server icon, select New Scope, and click Next.
-
In the scope window, input the scope name and detail information, and then click Next.
-
In the IP Address Range window, enter an address range and subnet mask for the scope, and click Next. A subnet mask, based on the address class, will be entered by default. You can modify this subnet mask, or click Next.
Note - You cannot modify the subnet mask after the scope has been created. Make sure that it is correct before continuing.
-
In the Add Exclusions window, input a range of addresses that are currently statically assigned, or are scheduled to be. Click Next.
-
In the Lease Duration window, set the lease time of the address. The default lease time is set to eight days (up from three days in NT4). Click Next.
-
In the Configure Your DHCP Options window, you have the option of entering settings including router, DNS, and WINS. You can elect to perform this configuration later by selecting the appropriate radio button. Click Next.
-
If you elect to configure the options, input the appropriate value into the subsequent windows for routers, domain name, and DNS servers and, finally, WINS servers.
-
In the Activate Scope window, click the radio button to activate the scope.
-
Click Next, and then click Finish.
Address Pools
After a DHCP scope is defined and exclusion ranges are applied, the remaining addresses form an available address pool within the scope. The Address Pool folder in the Scope folder contains the various address pools.
Exclusion Ranges
An exclusion range is a sequence of IP addresses within a scope that are excluded from assignment by the DHCP service.
Reservations
Reservations allow permanent address lease assignment to a host (such as a printer or dedicated engineering PC). The DHCP server reserves the address in its pool, ensuring that the host will always use the same IP address. Reservations ensure that the DHCP service does not duplicate or reassign the IP address. Reservations can be useful for network devices such as UNIX workstations, print servers, printers, and so on.
Each reservation requires a Media Access Control (MAC) from the network interface card (NIC) for the DHCP client.
Setting DDNS Update on a Scope
To configure DHCP to dynamically update DNS, you need to modify DHCP in the MMC DHCP snap-in.
Perform the following steps:
-
In the DHCP directory, right-click the specific scope folder and select Properties.
-
Select the DNS tab and check the Automatically Update DHCP Client Information in DNS box (see Figure 3.13).
-
If you want to make the update mandatory, click the Always Update DNS radio button. Otherwise, select the Update DNS Only If DHCP Client Requests button.
){kind=link}
Figure
3.13
Configuring the DHCP server for Dynamic DNS.
If you decide to let the client choose, the option is located in the Windows 2000 client's Advanced TCP/IP settings under the DNS tab (check the Register This Connection's Address in DNS box).