I've got a bunch of machines running in a sensitive network environment. I'm worried that one of the users might install the DHCP Server Role on one of the machines in the network and hose the environment.

Anybody know how to restrict the installation of this server role? I'm thinking Windows Group Policy or something along those lines?

  • 2
    The user has admin privilege to do this? – Phillip R. Mar 16 '12 at 22:12
  • windows does have other mechanisms to protect against rogue dhcp services but they are not perfect. I'd threaten the users with there lifes if they stupidly installed a dhcp server. But wtf would they have admin and still be stupid enough to install a dhcp server. – tony roth Mar 16 '12 at 23:13
  • Do you not have any smart switches/routers that can detect rogue DHCP servers? If users are going to have admin rights, perhaps they should be in their own VLAN? – Zoredache Mar 16 '12 at 23:28
  • 1
    1.Why do users have access to servers at a level that allows them to add roles? 2. What type of hosing do you think would occur? – joeqwerty Mar 16 '12 at 23:58
  • @joeqwerty- developers suck and take shortcuts, or the company they work for is too cheap to update the code from 1982 too make it not require admin rights on the server to run. – Jim B Mar 19 '12 at 16:45

IN a windows active directory domain you have to authorize a dhcp servre before it will start providing service. If you set up a standalone machine on a subnet with an authorized server, the standalone server will not provide service. See Authorizing DHCP servers for details on how servers are detected.

  • only wish this was bullet proof its not by any means. – tony roth Mar 17 '12 at 16:01
  • what have you seen to bypass this? I don't see how it's any less bulletproof than on the router. – Jim B Mar 18 '12 at 0:40
  • if he has a sensitive enviro then he should be more worried about non windows based dhcp servers and switchport protected will prevent any rogue dhcp server from servicing clients. – tony roth Mar 18 '12 at 19:30
  • Right but the solution to that is to turn on domain and server isolation, so that no rogue computers can communicate with any asset. thats that's basic windows security mechanism that should be in place regardless of DHCP role concerns. – Jim B Mar 19 '12 at 13:30
  • yes all true but something seems wierd about this question and I can't quite put my finger on it. – tony roth Mar 19 '12 at 13:43

If your users only have user privileges they won't be able to install any role. Having said that. You should really block this in your network switches.

  • This isn't a good answer. 1. An Administrator is a user, so what type of user priveleges are you referring to? If you meant standard user then you should be specific and state that. 2. Block it in the switches? Pray tell how that would be accomplished. Give some detail in your answer . – joeqwerty Mar 17 '12 at 0:01
  • This site is not for complete newbs so i think we all understand what rutgers was saying. And if your on a switched network you can enable switchport protected on all switch ports, then create an acl to prevent other dhcp servers from coming online. – tony roth Mar 17 '12 at 16:18
  • tony: I agree, but on the other hand, we shouldn't have to intepret what someone means in their answer, especially if the OP isn't experienced enough to "read between the lines". – joeqwerty Mar 18 '12 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.