13

How can I prevent a user that is an administrator on their local machine from manually assigning an IP to their network adapter that is in use on a server? Some users have done this, and it's caused duplicate IP issues that have taken nodes in clusters down in my organization.

7
  • 1
    What are you using for DHCP? Windows? Linux? Something else? You're going to want to create a pool for DHCP and exclude the IPs you're using for your servers. Dec 26, 2012 at 15:53
  • Your question was a little unclear, perhaps because English isn't your first language? I've edited it to make it a little easier to understand.
    – MDMarra
    Dec 26, 2012 at 16:03
  • 4
    @mdcp No way. Not if the users are local admins. And not if the machines aren't even in the domain - if I come to your office with my own laptop and plug in with an already-in-use IP and you're not doing something at Layer-2 to prevent damage (like 802.1x, NAC, etc), then I've just knocked something else off the network.
    – mfinni
    Dec 26, 2012 at 18:40
  • 2
    I would really like to know - why do people even do this? Dec 27, 2012 at 3:48
  • 1
    If your users are setting fixed IP addresses on their machines you need to think very hard about why they are doing it. In nearly all cases there will be some underlying problem that you should rectify. When your network (including things like DNS) is functioning correctly they should have no reason to do it. In other words, what do you need to fix to remove their reasons and thereby make this a non-issue? Dec 29, 2012 at 9:28

3 Answers 3

25
  1. Have a separate subnet (and preferably a separate VLAN) for your servers. This pretty much eliminates the issue of "accidental" overlap.

  2. Use some kind of NAC or port-level authentication and have a DHCP-assigned address be a prerequisite of the health check.

  3. Don't let your users be admin on their local machines :)

2
  • 1
    +1 All of the above =]
    – Chris S
    Dec 26, 2012 at 16:11
  • 9
    There is no way to prevent someone with local admin on a machine from assigning an already-in-use IP address, period. Because they own the machine, they can make it say whatever they want it to. All you can do is limit the damage - which, if you're using NAC or similar, it's capable of limiting the damage down to 0.
    – mfinni
    Dec 26, 2012 at 18:21
2

You could run a script using group policy to set the network adapter to use DHCP.

For example: http://social.technet.microsoft.com/Forums/zh/winserverGP/thread/b1616b2f-6353-45fb-a258-8ea9e14b5e8f

It looks like there may also be group policy to disable the network settings: How to disable Tcp/Ip settings in windows 7 via GPO?

2

Try enabling DHCP snooping. Every device connected to switch will have to issue DHCP request and receive valid reply from your trusted DHCP server before being able to use network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .