2

Why DHCP should not be installed on a domain controller?> What are drawbacks of it? What problems can be caused if I installed it on DC?

1
  • 2
    Who says it shouldn't?
    – joeqwerty
    Mar 1, 2011 at 16:23

2 Answers 2

5

This is not conventional wisdom. Perhaps you're confusing RRAS with DHCP? That's problematic because it multihomes the DC. DHCP on DCs is extremely common.

1

In addition, the DHCP Server service should not be placed on an Active Directory domain controller if this can be avoided. The reason for this is because this changes security related to service locator (SRV) records, which domain controllers are responsible for publishing. SRV records detail the location of domain controller s, Kerberos servers, and other servers, and the changes to the security of these records when you install DHCP means that the records could be altered by any client on the network. The reason this happens is because DHCP servers must be able to update client records dynamically if a client’s IP address changes. Because of this, they are made members of the DNSUpdateProxy group, and members of this group do not have any security applied to objects they create in the DNS database. If you can’t avoid placing DHCP on a domain con- troller, it is recommended that you remove the DHCP server from the DNSUpdateProxy group. This should avoid the security problem outlined here, but will also prevent the DHCP server from dynamically updating client records in DNS when the client IP addresses change.

Source: "Windows Server 2003 Inside Out"

3
  • That is a rather large security flaw in the OS.
    – adaptr
    Dec 15, 2011 at 16:12
  • This doens't make sense to me: Yes, the DHCP server can update ANY DNS record including the SRV records, but why does that allow that ANY client to alter those records ? It is still the trusted server that does the altering with data supplied by it's own service: The data doesn't come from the client.
    – Tonny
    Dec 15, 2011 at 16:32
  • If secure updates dynamic updates are enabled the DNSUpdateProxy group isn't necessary and this is not enabled. This is a very specific corner case which can be mitigated by removing the DC from DNSUpateProxy group if it is even there in the first place. technet.microsoft.com/en-us/library/cc961412.aspx Dec 15, 2011 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .