Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I prevent a user that is an administrator on their local machine from manually assigning an IP to their network adapter that is in use on a server? Some users have done this, and it's caused duplicate IP issues that have taken nodes in clusters down in my organization.

share|improve this question
1  
What are you using for DHCP? Windows? Linux? Something else? You're going to want to create a pool for DHCP and exclude the IPs you're using for your servers. –  cole Dec 26 '12 at 15:53
    
Your question was a little unclear, perhaps because English isn't your first language? I've edited it to make it a little easier to understand. –  MDMarra Dec 26 '12 at 16:03
4  
@mdcp No way. Not if the users are local admins. And not if the machines aren't even in the domain - if I come to your office with my own laptop and plug in with an already-in-use IP and you're not doing something at Layer-2 to prevent damage (like 802.1x, NAC, etc), then I've just knocked something else off the network. –  mfinni Dec 26 '12 at 18:40
2  
I would really like to know - why do people even do this? –  Richard Terrett Dec 27 '12 at 3:48
1  
If your users are setting fixed IP addresses on their machines you need to think very hard about why they are doing it. In nearly all cases there will be some underlying problem that you should rectify. When your network (including things like DNS) is functioning correctly they should have no reason to do it. In other words, what do you need to fix to remove their reasons and thereby make this a non-issue? –  John Gardeniers Dec 29 '12 at 9:28

3 Answers 3

Try enabling DHCP snooping. Every device connected to switch will have to issue DHCP request and receive valid reply from your trusted DHCP server before being able to use network.

share|improve this answer

You could run a script using group policy to set the network adapter to use DHCP.

For example: http://social.technet.microsoft.com/Forums/zh/winserverGP/thread/b1616b2f-6353-45fb-a258-8ea9e14b5e8f

It looks like there may also be group policy to disable the network settings: How to disable Tcp/Ip settings in windows 7 via GPO?

share|improve this answer
  1. Have a separate subnet (and preferably a separate VLAN) for your servers. This pretty much eliminates the issue of "accidental" overlap.

  2. Use some kind of NAC or port-level authentication and have a DHCP-assigned address be a prerequisite of the health check.

  3. Don't let your users be admin on their local machines :)

share|improve this answer
1  
+1 All of the above =] –  Chris S Dec 26 '12 at 16:11
9  
There is no way to prevent someone with local admin on a machine from assigning an already-in-use IP address, period. Because they own the machine, they can make it say whatever they want it to. All you can do is limit the damage - which, if you're using NAC or similar, it's capable of limiting the damage down to 0. –  mfinni Dec 26 '12 at 18:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.