I had an issue today where someone set a static IP on a test machine which happened to be my internet gateway. They then hooked to the primary network and screwed up outbound internet traffic.
I understand how to set up IP reservations in dhcp but I am not sure that will help me here since this was a static address.
Is there anything I can do at the domain level to prevent issues like this in the future?
Barring educating the users I can only think of one thing: Add a fixed ARP address for that IP on managed switches.
And document it, since it is going to be fun when you replace the gateway.
Edit: I just realized that that solves the specific problem you had, but not the question in in title. Well, not unless you add a lot of fixed ARP entries to your switches. And that is something to avoid.
Nothing inherent in AD will help you here.
But, if you are using Cisco switches then you want [IP Source Guard][1], which is a complement to DHCP snooping. If a device does not receive an address for DHCP or tries to use an IP address not assigned via DHCP, the packet is dropped (or the port is disabled, depending on your iOS version).
I'm sure other switch vendors have similar features.
Not domain level (can't think of anything else domain ralted than not to let user use static IPs), but can you set up a firewall between test and production networks? Then you could drop incorrect traffic.
