1

Is it possible to assign a security group in windows 2008 a specific DHCP scope?

Meaning, let's say we have 2 groups, employees and managers in the superscope Company. Assuming that each user is distinctly in either group and there are no overlaps, would it be possible to assign members of the security group employees a dhcp address in the range 192.168.1.0/24 and managers 192.168.2.0/24 ?

The DHCP server is the same server.

This is on Windows SBS 2008 if it makes any difference

If it is possible, how do you go about setting it up.

TIA

Improve this question
1
  • Some quantity of 802.1x and dynamic VLAN assignment can probably do waht you want in an ugly and hackish fashion (since the PC will need an IP address prior to a user logon). Likely you can accomplish your intended end-goal (which probably has something to do with Internet bandwidth allocation or filtering / monitoring of web site access) w/o doing it via assigning certain IP addresses to "people" (which is a fundamentally hard problem, since "people" don't have IP addresses).
    – Evan Anderson
    Dec 28, 2009 at 16:48

1 Answer 1

Reset to default
0

The base problem is that Active Directory doesn't consider "IP address" to be a property for 'people'. It barely considers that for Machines, if only because that's how it determines which 'Site' you are in. To the best of my knowledge there is no native way to accomplish this using pure Microsoft tools.

As Evan said, the process flow for this solution has these steps:

  1. User Login
  2. Some watchdog process notices this, and triggers a...
  3. Dynamic VLAN change for that ethernet jack, based on what security group the user is in (doubtlessly obtained via LDAP query, since this'll have to be a non-Microsoft product that does this)
  4. The local machine is forced to request a DHCP address somehow.
  5. The DHCP server assigns it an IP address based on the network the computer is on.

Steps 2-4 are the problems that'll require custom engineering. During the changeover from startup IP to running IP that machine will be effectively offline, which can muck up any number of events that happen on-login. Supporting this will require a managed switching environment with these kinds of features, and almost definitely an 802.1x solution as they're in the best position to do these kinds of network reconfigs on the fly.

Improve this answer

You must log in to answer this question.