DHCP Authorisation - does it stop rouge DHCP servers?

Hi,

Can you use DHCP Authorisation to stop rouge DHCP servers supplying PC with
IP addresses?

Thanks, Ben

Hi Ben, yes it is exactly for that purpose and both Server 2003 and 2008
(longhorn) support this, it will also check and i beleive these times are
valid for both O/S versions. but authorised servers check every 60 minutes
and unauthorised check every 10 minutes sending out a DHCPINFORM request. the
links below go into more detail on the processes used.

w2k
http://technet2.microsoft.com/window....mspx?mfr=true
w2k8

http://technet2.microsoft.com/window....mspx?mfr=true
--
D3L3R1u5


"Ben UK" wrote:

> Hi,
>
> Can you use DHCP Authorisation to stop rouge DHCP servers supplying PC with
> IP addresses?
>
> Thanks, Ben

"Ben UK" wrote:

> Hi,
>
> Can you use DHCP Authorisation to stop rouge DHCP servers supplying PC with
> IP addresses?
>
> Thanks, Ben

Alas not quite.
In an AD-integrated domain it prevents unauthorised DHCP server on a domain
member from supplying IP addresses.
But routers and firewalls which have DHCP capability must have this disabled
before plugging them into an AD-integrated domain.
Also it is helpless to deal with a DHCP server on a computer which is not a
domain member, but has a suitable IP and sub-net mask when plugged into the
LAN.

--
Regards,
Newell White

Hi Newel, Are you refering to W2K3 or W2K8 when you say the authorisation
protection does not work?
I've persoanlly tested both non domain & Domain members with DHCP service
added but Not Authorised in AD, the DHCP servers would affectiviely shut down
and not hand out address's, and that was regardless of what VLAN's i placed
them into although one exception i can see is if a Linux based DHCP Server is
used.

--
D3L3R1u5


"Newell White" wrote:

>
> "Ben UK" wrote:
>
> > Hi,
> >
> > Can you use DHCP Authorisation to stop rouge DHCP servers supplying PC with
> > IP addresses?
> >
> > Thanks, Ben
>
> Alas not quite.
> In an AD-integrated domain it prevents unauthorised DHCP server on a domain
> member from supplying IP addresses.
> But routers and firewalls which have DHCP capability must have this disabled
> before plugging them into an AD-integrated domain.
> Also it is helpless to deal with a DHCP server on a computer which is not a
> domain member, but has a suitable IP and sub-net mask when plugged into the
> LAN.
>
> --
> Regards,
> Newell White
>

I am talking about W2k3.

I agree that if you set up DHCP on a Windows machine and don't 'Authorise'
it, then that machine will not respond to requests for an IP address, whether
domain member or not.

I was cautioning OP that AD can not prevent a rogue DHCP server from
responding to a DHCPdiscover with a DHCPoffer, and if it gets in first then
hell breaks loose.
Try plugging a broadband modem/router into your LAN without first using an
isolated workstation to disable its' DHCP server - if it has an internal IP
and mask that overlaps your LAN it will respond to any DHCP broadcasts very
quickly.

--
Regards,
Newell White


"D3L3R1u5" wrote:

> Hi Newel, Are you refering to W2K3 or W2K8 when you say the authorisation
> protection does not work?
> I've persoanlly tested both non domain & Domain members with DHCP service
> added but Not Authorised in AD, the DHCP servers would affectiviely shut down
> and not hand out address's, and that was regardless of what VLAN's i placed
> them into although one exception i can see is if a Linux based DHCP Server is
> used.
>
> --
> D3L3R1u5
>
>
> "Newell White" wrote:
>
> >
> > "Ben UK" wrote:
> >
> > > Hi,
> > >
> > > Can you use DHCP Authorisation to stop rouge DHCP servers supplying PC with
> > > IP addresses?
> > >
> > > Thanks, Ben
> >
> > Alas not quite.
> > In an AD-integrated domain it prevents unauthorised DHCP server on a domain
> > member from supplying IP addresses.
> > But routers and firewalls which have DHCP capability must have this disabled
> > before plugging them into an AD-integrated domain.
> > Also it is helpless to deal with a DHCP server on a computer which is not a
> > domain member, but has a suitable IP and sub-net mask when plugged into the
> > LAN.
> >
> > --
> > Regards,
> > Newell White
> >