1

We are runing a Windows Server 2012 DC which also takes care of DHCP. Now I want to limit the DHCP-Server to all the reserved hosts to prevent DHCP leases for foreign devices as laptops, smartphones,...

I found an article that described the proceeding for limitation to a number of mac addresses but this seems to be a very pimply solution. Are there other ways to prevent unwanted dhcp leases?

Improve this question

2 Answers 2

Reset to default
3

In the DHCP console:

Enable the Allowed List filter:

  • Right-click on IPv4 and go to Properties
  • Click the Filtering tab
  • Check the box next to Enable Allow List
  • Make sure the box next to Enable Deny List is NOT checked

This will cause the DHCP server to only issue IP addresses to clients within the Allowed filter list.

Add a MAC to the Allowed list:

  • Expand IPv4
  • Expand Filters
  • Right-click Allow
  • Select New Filter...
  • Enter the desired MAC address and Press OK
Improve this answer
1
  • I like this answer because it answers the question without inflating the scope of the inquiry, and it is still valid in Windows Server 2022. However, do note that the security concerns noted in other responses are valid considerations, and that you can fool this system with simple MAC address spoofing.
    – technonaut
    Jan 7 at 16:52
2

Use security on the switch port, such as 802.1x. Don't rely on DHCP as a security mechanism.

Improve this answer
4
  • I know that this is not a reliable security mechanism. But I have to do this anyway...
    – davidb
    Mar 7, 2016 at 12:28
  • @davidb Consider that a malicious user can simply set a static IP on their device after they connect to the switchport. If you actually care one bit about security, you won't do it via DHCP. If it's just for show to appease somebody, then sure.
    – MDMarra
    Mar 7, 2016 at 18:01
  • Im absolutely aware of that. This is only to prevent employees from attaching their own devices...
    – davidb
    Mar 7, 2016 at 18:47
  • @MDMarra That's not an issue if you are applying ip source guard on your switches.
    – Zulakis
    Jun 17, 2021 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .