Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

Why DHCP should not be installed on a domain controller?> What are drawbacks of it? What problems can be caused if I installed it on DC?

share|improve this question
2  
Who says it shouldn't? – joeqwerty Mar 1 '11 at 16:23

2 Answers

up vote 5 down vote

This is not conventional wisdom. Perhaps you're confusing RRAS with DHCP? That's problematic because it multihomes the DC. DHCP on DCs is extremely common.

share|improve this answer
up vote 1 down vote

In addition, the DHCP Server service should not be placed on an Active Directory domain controller if this can be avoided. The reason for this is because this changes security related to service locator (SRV) records, which domain controllers are responsible for publishing. SRV records detail the location of domain controller s, Kerberos servers, and other servers, and the changes to the security of these records when you install DHCP means that the records could be altered by any client on the network. The reason this happens is because DHCP servers must be able to update client records dynamically if a client’s IP address changes. Because of this, they are made members of the DNSUpdateProxy group, and members of this group do not have any security applied to objects they create in the DNS database. If you can’t avoid placing DHCP on a domain con- troller, it is recommended that you remove the DHCP server from the DNSUpdateProxy group. This should avoid the security problem outlined here, but will also prevent the DHCP server from dynamically updating client records in DNS when the client IP addresses change.

Source: "Windows Server 2003 Inside Out"

share|improve this answer
That is a rather large security flaw in the OS. – adaptr Dec 15 '11 at 16:12
This doens't make sense to me: Yes, the DHCP server can update ANY DNS record including the SRV records, but why does that allow that ANY client to alter those records ? It is still the trusted server that does the altering with data supplied by it's own service: The data doesn't come from the client. – Tonny Dec 15 '11 at 16:32
If secure updates dynamic updates are enabled the DNSUpdateProxy group isn't necessary and this is not enabled. This is a very specific corner case which can be mitigated by removing the DC from DNSUpateProxy group if it is even there in the first place. technet.microsoft.com/en-us/library/cc961412.aspx – Tim Brigham Dec 15 '11 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.