Active Directory is very tightly coupled to DNS. DNS relates the IP to a hostname.

If the IP is always changing on a machine, by way of a dynamic IP, would this make it a very bad idea to join a machine to a domain?

A DC is also recommended to have a static IP. Is this for similar reasons (ie it would be hard to resolve the IP to hostname if the IP is always changing).

For example, in the enterprise, for machines to be joined to the domain, we are always given a block of static IPs so I guess I must be on the right tracks?



You're right in saying that Active Directory is tightly coupled to DNS. However, if what I think you're asking is "are static IPs a bad idea?", then no, they're not. Quite the opposite.

It is a generally accepted practice to make all servers and printers in an organization have a static IP address and utilize DHCP for managing the rest of the network via scope.

You can use DHCP for keeping track of static (not manually assigned) IPs via reservations.

The way we do it in our network is we have a scope to accomodate all user PCs. There are some static IPs (in the scope) that we assign via reservation (for those machines that require a static IP). All other IPs fall outside of the scope area and are static (manually assigned) IPs for servers, routers, firewalls, printers, etc.

  • Exactly right. For @blade's benefit, the usual reason why a user PC would need a reserved IP address is for remote access via RDP or similar protocols (e.g. from a conference room, or from off-site via VPN). – Skyhawk Aug 16 '10 at 0:43
  • 2
    Not to nitpick, but an address assigned through a reservation is not a static IP. It still receives DHCP options that are specified either globally or on a per-scope basis and it will not be assigned in the event of a DHCP server failure. – MDMarra Aug 16 '10 at 1:34
  • Sorry guys, I actually meant are dynamic IPs a bad idea? My title is wrong. Apologies. – GurdeepS Aug 16 '10 at 18:46

A domain controller must have a static IP.

Client machines can have dynamic IPs because of dynamic DNS record updates. It is not a great idea to assign static IPs to clients, it is much much easier to let DHCP do that.


If the IP is always changing on a machine, by way of a dynamic IP, would this make it a very bad idea to join a machine to a domain?


First - why the heck does the IP always change? DHCP has a method do lease the IP to a machine, and hte lease should be long enough that the machine does NOT always change IP. Always changing IP = configuration error in DNS.

Second, so what? Put the IP in static. And? IThe computer will maintain it's DNS information as it did before, jsut always have the same IP. I do that with pretty much all servers so that they can start after a failure (power outage) without having to delay for the DHCP server takes some time to get up.

For example, in the enterprise, for machines to be joined to the domain, we are always given a block of static IPs so I guess I must be on the right tracks?

Like in most enterprises, this goes back to some guy not being competent in his job (idiots at work). As long as the DNS supports dynamic regisitration (and windows DNS does) there is exactly NO (!) issue with dynamic IP addresses for all machines. DC's are special as a DC must be able to find A WORKING DNS to connect to the domain and start, and if the DNS' reset, all DNS may be off. it makes sense to keep the domain controllers static, pointing to each other for DNS purposes, to make AD start faster.

All other machines CAN be on dynamic IP addresses (which also does not mean constantl changing - this is another "idiot at work" issue, leases should be long enough for machines to not wander around randomly, except maybe after a holiday - 5-8 days is a good time), although, as others have pointed out, it is very good practice to put servers and all "primitive" items on static IP (mostly because the primitive items like printers often lack the methods to update their DNS information, which makes them wandering around hard, and servers you want to come up fast afte ra reboot).

The main issue with server is the "static" nature eof DHCP in Ipv4... It is queried for ONCE, never again. So if the DHCP server is not available when th server boots - it does not get a configuration. This is different to IpV6 where the IP addresses (wel, networks) can be assigned post boot, a routers announce all the networks they can handle and all machines in the network pick them up (and drop them) as routers become visible / invisible.

  • I feel it necessary to point out that just picking a DHCP lease length out of thin air is a bad idea. Considerations should be made for the number of devices that are usually concurrently attached to the network, the number of devices that roam onto and off of the network, the frequency with which those devices come and go, the size of the collective addressing pools in that scope, etc. My lease lengths are much shorter than your 5-8 days. I don't recall exactly, but it's less than one business day, and I have no problems at all with devices changes IP's frequently (and I know DHCP spec). – aNullValue Aug 16 '10 at 3:28
  • Also, devices using DHCP will request from the DHCP server that their lease be renewed, prior to expiration. The DHCP server should renew the lease, unless it has specific directive to deny the request. IP addresses frequently changing is frequently a symptom of pool exhaustion. As for domain controllers, you must use static IP addressing for numerous reasons outside the scope of this discussion. – aNullValue Aug 16 '10 at 3:33
  • Finally, your comment regarding Windows DNS supporting dynamic updates -- yes, it does, both client and server. We don't know that they're running Windows DNS server, though, we just know that they're running Active Directory, some flavor of DHCP, some flavor of DNS, and windows workstations. – aNullValue Aug 16 '10 at 3:35

There are various opinions on this, but it's technical necessity that domain controllers must have static IP addresses. (edit: There are ways that domain controllers can be operated without static assignments, but it is very much against best practices. The static assignment requirement is also largely based on DNS assignment requirements.) It is extremely common that all servers in an organization be manually assigned static IP addresses.

For printers, scanners, and other devices that frequently need to be referred to by IP address, there are multiple trains of thought -- 1) manually assign a static IP address, 2) use a DHCP reservation so that the machine is always handed the same IP address via DHCP, or 3) rely on dynamic DNS for addressing the host, and let the device use non-reserved DHCP. I personally follow method #2 for all of the networks I manage; I find that it's much easier to manage IP addressing and change device IP addresses if they're being handed reservations from a DHCP server, rather than having to go to the device and change it there.

Most end-user computers are handed IP addresses by DHCP. It quickly becomes difficult to keep track of which IP addresses are being used where and by what on all but the tiniest of networks. It's very common for Windows servers and clients to use dynamic DNS to update the appropriate A record(s). Some administrators prefer to statically assign IP addresses to end-user PCs when they are being accessed remotely (RDP, etc). I take the approach that dynamic IP addressing is best, and rely on dynamic DNS for that also. I really, really dislike statically assigning addresses to anything besides servers.

Regarding @blade's statement that he is given blocks of static IP addresses for use when joining a domain, that's more of a network administration policy than a technical requirement.

  • It's not technically necessary for a DC to have a static IP; I've got a set of training servers setup that all use DHCP. Best practices, no, not at all; but it works. – Chris S Aug 16 '10 at 3:40
  • I've revised my post. Yes, domain controllers can be made to work without static IP addresses, but it's very much against best practices. The static IP address requirements are, IIRC, largely because of DNS requirements -- clients have to be given a particular IP address (1 or more) to resolve hosts, and that IP can't (easily) change. Domain controllers also tend not to be amused when their peers are online but with different IP addresses, breaking replication if DNS is also local to the DCs. – aNullValue Aug 16 '10 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.