Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to know if there is a way to deny leasing an IP address through my MS DHCP server to computers which are not registered in my domain.

Thanks!

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You won't be able to restrict in on a domain basis as the client would need to be able to connect to your network via IP before it's credentials are validated via a Domain Controller. Having said that however, there is a DLL available that enables you to prevent unauthorised MAC addresses from getting a DHCP assigned address but this requires the administrator to enable this functionality and to register the MAC addresses of the network cards that you want to allow.

For more information on this option check this link DHCP Server callout DLL for MAC address based filtering

Note: This DLL may no longer be available as the functionality was added with Windows 2008 R2 and I'd last used this with Windows 2003 hosts some time ago.

share|improve this answer
    
Thank you! Very appreciated! –  Edy the computer guy Aug 24 at 15:44

RFC 3118 allows for authentication in DHCP messages although AFAIK it isn't implemented in the current DHCP servers.

If you want to secure your network a better approach is IEEE_802.1X where clients must authenticate themselves to the switch port before they can access the network.

That means that even if an unauthenticated system is configured with a static IP-addres and doesn't use DHCP ; it still can't use your network.

share|improve this answer
    
Thanks! Very appreciated! –  Edy the computer guy Aug 24 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.