Some of my users need to have an IP from a specific range to use some services and some others don't. Since many users have access to different PCs (and sometimes they share the same PCs, too) is it possible for Windows Server 2012 DHCP to assign an IP address based user name?

I did some researches and it looks like it's not possible, since the DHCP addresses are assigned before a user logs in. Am I right?

I found that DHCP policies in Windows Server can be based on one ore more of these parameters:

  • MAC Address
  • Vendor Class
  • User Class
  • Client Identifier
  • Relay Agent Information

but I think they are all related to the hardware installed on the PC.

How can I solve this problem? I thought about a login script that changes the IP after the login, but in this case I need to statically assign a different IP to each user. Is there a way to achieve this dynamically?

  • 1
    Why would you want this? Seems like adding needless complexity. If you're looking at using some kind of Internet usage monitoring solution most of the "name brand" offerings support either transparent proxy authentication by the clients or, alternatively, some kind of "agent" to detect the logged-on user. – Evan Anderson Feb 4 '13 at 20:40
  • 1
    @EvanAnderson You see this sort of thing a lot in education. If a student is logging in to a lab computer you might want them in a different VLAN than an administrator logging into the same computer. Or you might want faculty/staff to be on a different wireless VLAN with different ACLs (or traffic shaping policies) than a student, but you don't want to mess with multiple SSIDs, so you handle it with 802.1x or one of the fancy packages that puts a neat bow on it like Clean Access. – MDMarra Feb 4 '13 at 20:43
  • Thank you all for your answers. @EvanAnderson we need this because some users have to access a VPN, some others don't, and our goal is not to install the VPN client on each PC, but create something that works at a lower level (transparent to the final user). – J.B. Feb 4 '13 at 20:55
  • 1
    The HUGE issue with this is that this could be bypassed by simply setting a static IP address on the machine. This is the kind of thing that 802.1x and NAP were created for. – woodsbw Feb 4 '13 at 21:45
  • 2
    That isn't really something I can cover in the comments, and it doesn't really belong in this question they way you have asked it. I kinda think you asked the wrong question, by proposing an unusual solution. You should have focused a lot more on explaining your actual root problem. – Zoredache Feb 4 '13 at 21:45

What you want to do is some form of 802.1x at the switch level with something like a NAP (Windows) or FreeRADIUS (*nix) back end. When a client connects initially, they are all put on a "quarantine" VLAN that doesn't have access to anything except logging in. Then, based on either their computer certificate or logon name or group membership in AD, they are put on the correct VLAN at the switch-port level.

You can't do this natively with DHCP, you need switches that support 802.1x and RADIUS as a minimum or something like Cisco Clean Access or ISE, but those do far more than VLAN quarantining.

| improve this answer | |
  • 1
    DHCP won't do this for you because: by the time you've logged in, your PC has already been assigned an IP address. – longneck Feb 4 '13 at 20:35
  • Sorry, didn't mean to imply that you did. Just wanted to add to your already excellent answer. :) – longneck Feb 4 '13 at 20:37
  • 1
    This ^ is how you do it. Takes a bit to setup...but it will work, and work securely. – woodsbw Feb 4 '13 at 21:47

Not using any sane built-in method.

There's two reasons:

  1. DHCP leases are renewed at either boot time (to get an IP address), or half way through their lease time (so on a 7 day lease, they are renewed at 3.5 days), or if that renewal is unsuccessful then more frequently. But there's at least a (for example) 3.5 day wait between renewals
  2. No DHCP agents or servers will send the logged on user as part of its request (as it's not in the spec).

I guess if we're waving hands around, you could possibly do this with a logon script. Send a request to your custom-made DHCP server, get a custom-made DHCP response (to your script) and then manually set the IP address. Or, perhaps, send a custom-made request to the DHCP server that adjusts your resevation IP address and then manually trigger a renewal, but they're both Doing It Wrong TM

| improve this answer | |

Take a look at Remote Desktop Services IP Virtualization. You will be able to assign IPs per session. I don't know whether you can control which IP is assigned to a user. More to find in the RDS team blog:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.