How can I prevent a user that is an administrator on their local machine from manually assigning an IP to their network adapter that is in use on a server? Some users have done this, and it's caused duplicate IP issues that have taken nodes in clusters down in my organization.
-
1What are you using for DHCP? Windows? Linux? Something else? You're going to want to create a pool for DHCP and exclude the IPs you're using for your servers.– colealtdeleteDec 26, 2012 at 15:53
-
Your question was a little unclear, perhaps because English isn't your first language? I've edited it to make it a little easier to understand.– MDMarraDec 26, 2012 at 16:03
-
4@mdcp No way. Not if the users are local admins. And not if the machines aren't even in the domain - if I come to your office with my own laptop and plug in with an already-in-use IP and you're not doing something at Layer-2 to prevent damage (like 802.1x, NAC, etc), then I've just knocked something else off the network.– mfinniDec 26, 2012 at 18:40
-
2I would really like to know - why do people even do this?– Richard TerrettDec 27, 2012 at 3:48
-
1If your users are setting fixed IP addresses on their machines you need to think very hard about why they are doing it. In nearly all cases there will be some underlying problem that you should rectify. When your network (including things like DNS) is functioning correctly they should have no reason to do it. In other words, what do you need to fix to remove their reasons and thereby make this a non-issue?– John GardeniersDec 29, 2012 at 9:28
3 Answers
Have a separate subnet (and preferably a separate VLAN) for your servers. This pretty much eliminates the issue of "accidental" overlap.
Use some kind of NAC or port-level authentication and have a DHCP-assigned address be a prerequisite of the health check.
Don't let your users be admin on their local machines :)
-
1
-
9There is no way to prevent someone with local admin on a machine from assigning an already-in-use IP address, period. Because they own the machine, they can make it say whatever they want it to. All you can do is limit the damage - which, if you're using NAC or similar, it's capable of limiting the damage down to 0.– mfinniDec 26, 2012 at 18:21
You could run a script using group policy to set the network adapter to use DHCP.
For example: http://social.technet.microsoft.com/Forums/zh/winserverGP/thread/b1616b2f-6353-45fb-a258-8ea9e14b5e8f
It looks like there may also be group policy to disable the network settings: How to disable Tcp/Ip settings in windows 7 via GPO?
Try enabling DHCP snooping. Every device connected to switch will have to issue DHCP request and receive valid reply from your trusted DHCP server before being able to use network.