{"id":809,"date":"2012-07-25T22:22:34","date_gmt":"2012-07-25T22:22:34","guid":{"rendered":"http:\/\/microsoftgeek.com\/?p=809"},"modified":"2018-09-06T23:16:00","modified_gmt":"2018-09-06T23:16:00","slug":"windows-server-2008-r2-improvements-in-dhcp","status":"publish","type":"post","link":"https:\/\/microsoftgeek.com\/?p=809","title":{"rendered":"Windows Server 2008 R2 Improvements in DHCP"},"content":{"rendered":"<p>In this article, we&#8217;ll go over some of the new and cool features included in the Windows Server 2008 R2 DHCP server.<\/p>\n<h2>Introduction<\/h2>\n<p>DHCP is something most IT pros take for granted. However, it wasn\u2019t really all that long ago when many of us were running local NetBEUI networks, where addressing wasn\u2019t even an issue. On NetBEUI networks, all you needed to do was name the computers whatever names you wanted, making sure that you didn\u2019t duplicate names, and you were good. Of course, being a broadcast based name resolution protocol that wasn\u2019t routable meant there was a healthy amount of traffic on your single broadcast domain.<\/p>\n<p>Then along came the Internet and with it, the TCP\/IP protocol. With TCP\/IP, we saw big improvements in network performance because not everyone was on the same Ethernet broadcast domain; we could now have routed networks. The whole name resolution process changed, in that now we needed to think about using DNS for name resolution on our networks. And addressing? We didn\u2019t need to worry about addressing at all with NetBEUI but now with TCP\/IP addressing was everything.<\/p>\n<p>When we were just starting out with TCP\/IP, many of us manually assigned addresses on our small networks. But then we discovered the conveniences of DHCP and how DHCP can automatically assign IP addresses to the computers on the network. What a wonderful discovery that was; by using DHCP we could assign IP addresses, subnet masks, domain names, default gateway and even more by using DHCP options. It was clear that DHCP was here to stay and would be a constant companion in our networking lives.<\/p>\n<p>However, that was over 20 years ago and the excitement about DHCP has faded quite a bit in the interim. You design and then plan your DHCP network infrastructure, and then you deploy it. You back up the databases and restore them when you need to. That\u2019s about it. It just works and rarely do you hear any complaints about addressing issues.<\/p>\n<p>But now, with Windows Server 2008 R2, there\u2019s something new on the DHCP front, and in this article, I\u2019ll tell you about these cool new features. The new DHCP features that you\u2019ll find in Windows Server 2008 R2 include:<\/p>\n<ul>\n<li>MAC addressing filtering for DHCP leases<\/li>\n<li>Generate link layer address filtering lists from current leases<\/li>\n<li>Create reservations from current leases<\/li>\n<li>DHCP name protection<\/li>\n<li>Create new DHCP options that apply only to reservations<\/li>\n<li>Integration with NAP<\/li>\n<li>DHCP logging enhancements<\/li>\n<li>DHCP Split Scope Wizard<\/li>\n<li>Delayed DHCP Server Response Setting<\/li>\n<\/ul>\n<h2>MAC addressing filtering for DHCP leases<\/h2>\n<p>In Windows Server 2008 R2 you can now create \u201callow\u201d and \u201cdeny\u201d filter lists for MAC addresses in DHCP. We\u2019re used to creating such lists on small wireless networks, but why not do the same thing on both your wired and wireless networks? You can make it easier to exert some control over who connects to your network by configuring your MAC address allow and deny lists in your DHCP server.<\/p>\n<p>You can access this feature by opening the DHCP console and navigating down to the <strong>Filters<\/strong> node in the IPv4 tree (note that filters are not available for IPv6 addresses). You have two options when you right click the <strong>Allow<\/strong> or <strong>Deny<\/strong> node \u2013 <strong>New Filter<\/strong> and <strong>Enable<\/strong>. In general, you should have your list of MAC addresses that you want to allow or deny first, then create the filter entries, and then enable the allow or deny options. You can see an example of this in the figure below.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0021329854955362.jpg\" width=\"255\" height=\"280\" \/><br \/>\n<strong>Figure 1<\/strong><\/p>\n<p>When you select the <strong>Filter<\/strong> option, you will see the <strong>New Filter<\/strong> dialog box, where you enter a <strong>MAC address<\/strong> and an optional <strong>Description<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0041329854955362.jpg\" width=\"410\" height=\"337\" \/><br \/>\n<strong>Figure 2<\/strong><\/p>\n<p>You\u2019d think that after you click <strong>Enable<\/strong> it will enable MAC address filtering for your allow and deny lists. However, there is one more thing you need to do. Right click <strong>IPv4<\/strong> in the left pane of the console and click <strong>Properties<\/strong>. Then in the <strong>IPv4 Properties<\/strong> dialog box, click the <strong>Filters<\/strong> tab. Put checkmarks in the <strong>Enable Allow List<\/strong> and\/or <strong>Enable Deny List<\/strong> depending on what you want to do. Note the warning here: clients that had previously received IP addresses will be denied address renewal, unless their MAC addresses\/patterns are present in the allow list. So, before you start your MAC address filtering, make sure to read the next section, which will make entering MAC addresses in your allow list a lot easier.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0061329854955362.jpg\" width=\"404\" height=\"447\" \/><br \/>\n<strong>Figure 3<\/strong><\/p>\n<h2>Generate reservations and link layer address filtering lists from current leases<\/h2>\n<p>You could add new filtering lists by entering the MAC addresses of all the machines on your network in an Excel spreadsheet and then entering each of these, one at a time, in the DHCP console. However, that would take a while. The new DHCP console makes it easier to add MAC addresses to your filter list by using your existing leases. All you need to do is select one or more of the reservations from the list, then right click and then click <strong>Add to Filter<\/strong> and then <strong>Allow<\/strong> or <strong>Deny<\/strong>, as you can see in the figure below. This is a lot better than trying to hunt down MAC addresses and entering them one at a time.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0081329855063518.jpg\" align=\"bottom\" border=\"0\" hspace=\"0\" \/><br \/>\n<strong>Figure 4<\/strong><\/p>\n<p>Notice when we right click on the entry in the leases list that there is another option: <strong>Add to Reservation<\/strong>. All you need to do it select one or more entries in the leases list and then right click the selection and click <strong>Add to Reservation<\/strong>. After you do that, you\u2019ll see a dialog box informing you that the lease was added to a Reservation, as seen in the figure below.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0101329855104158.jpg\" width=\"310\" height=\"146\" \/><br \/>\n<strong>Figure 5<\/strong><\/p>\n<h2>DHCP Name Protection<\/h2>\n<p>The Windows Server 2008 R2 DHCP server can work together with DNS to prevent DNS name entries from being overwritten. Right click <strong>IPv4<\/strong> in the left pane of the console and click <strong>Properties<\/strong>. In the <strong>IPv4 Properties<\/strong> dialog box, click the <strong>DNS<\/strong> tab, as seen in the figure below.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0121329855104158.jpg\" width=\"413\" height=\"454\" \/><br \/>\n<strong>Figure 6<\/strong><\/p>\n<p>In the <strong>Name Protection<\/strong> frame, click the <strong>Configure<\/strong> button.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0141329855104158.jpg\" width=\"413\" height=\"459\" \/><br \/>\n<strong>Figure 7<\/strong><\/p>\n<p>When this option is enabled, the DHCP server will register A and PTR records on behalf of the client. However, if there is a name already registered in DNS which is the same, the DHCP update will fail. There are a few things you need to understand about this feature before you use it:<\/p>\n<ul>\n<li>DHCP will honor requests for A and PTR records registration for Windows DHCP clients<\/li>\n<li>DHCP server will dynamically update A and PTR record for non-Windows DHCP clients<\/li>\n<li>DHCP server will discard A and PTR records when a lease is deleted<\/li>\n<li>Secure Dynamic Updates must be enabled for Name Protection to work<\/li>\n<\/ul>\n<h2>Create new DHCP options that apply only to reservations<\/h2>\n<p>Reservations are often created for servers with specific purposes that lie outside the general IP address settings that you would assign to other machines on the network. For example, you might want to configure specific routes or name servers or default gateways to machines that have a DHCP reservation. You can do this by navigating to the <strong>Reservations<\/strong> folder in the left pane of the console and then expanding that node and clicking on the name of the machine with the reservation to which you want to assign specific DHCP options, as seen in the figure below.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0161329855104174.jpg\" width=\"342\" height=\"255\" \/><br \/>\n<strong>Figure 8<\/strong><\/p>\n<p>Right click the name of the machine and then click <strong>Configure Options<\/strong>. This brings up the <strong>Reservation Options<\/strong> dialog box, as seen in the figure below. Select and configure your DHCP options and they will be applied only to this machine. Nice huh?<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0181329855153799.jpg\" width=\"408\" height=\"454\" \/><br \/>\n<strong>Figure 9<\/strong><\/p>\n<h2>Integration with NAP<\/h2>\n<p>NAP is Network Access Protection, which is a NAC (Network Access Control) type feature in Windows Server 2008 R2 that allows you to control, to a certain extent, which devices can connect to your network. NAP uses three methods that you can choose from to allow you to control who can connect to your network:<\/p>\n<ul>\n<li>DHCP Enforcement<\/li>\n<li>IPsec Enforcement<\/li>\n<li>802.1X Enforcement<\/li>\n<\/ul>\n<p>If you choose to use DHCP enforcement, machines that pass NAP inspection will be allowed to connect to the network through assignment of a valid IP address assigned via DHCP. NAP configuration is somewhat complex and involves configuration of several servers and services, including Group Policy, Network Policy Services, DHCP and others. We won\u2019t go into all of that here, but you can find out more on <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc730902%28WS.10%29.aspx\">Microsoft\u2019s TechNet<\/a> site. Our focus here is DHCP, and if you want to use DHCP enforcement, you will need to configure the DHCP server. Here\u2019s how:<\/p>\n<p>Right click <strong>IPv4<\/strong> in the left pane of the console and click <strong>Properties<\/strong>. In the <strong>IPv4 Properties<\/strong> dialog box, click the <strong>Network Access Protection<\/strong> tab. On this tab, you have these options:<\/p>\n<ul>\n<li><strong>Enable on all scopes<\/strong><\/li>\n<li><strong>Disable on all scopes<\/strong><\/li>\n<\/ul>\n<p>These options allow you to enable NAP DHCP enforcement on all scopes, and if you enable it and then want to disable it, to disable NAP DHCP enforcement on all scopes. Also, as you can see in the figure below, you can control DHCP server behavior when the Network Policy Server (NPS) is unreachable. You have the option of granting the clients <strong>Full Access<\/strong>, <strong>Restricted Access<\/strong> or <strong>Drop Client Packet<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0201329855153799.jpg\" width=\"408\" height=\"454\" border=\"0\" \/><br \/>\n<strong>Figure 10<\/strong><\/p>\n<h2>DHCP logging enhancements<\/h2>\n<p>You get a lot more logging information in the Windows Server 2008 R2 DHCP server. Whenever you make a change to the DHCP configuration, you will see information about that change in the Event Viewer. Also, a daily log is kept that records DHCP activity in the location %Systemroot%\\system32\\DHCP. You can see an example of that log in the figure below.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0221329855169987.jpg\" align=\"bottom\" border=\"0\" hspace=\"0\" \/><br \/>\n<strong>Figure 11<\/strong><\/p>\n<p>You can also install the DHCP Server Events Tool MMC snap-in to get to this information. For more information on this tool, check out <a href=\"http:\/\/blogs.technet.com\/b\/teamdhcp\/archive\/2009\/03\/20\/tool-to-read-dhcp-server-events-for-windows-server-2008-r2.aspx\">this link<\/a>.<\/p>\n<h2>DHCP Split Scope Wizard and Delayed DHCP Server Response Setting<\/h2>\n<p>As a best practice, you should split your DHCP scopes among multiple DHCP servers, so that a single DHCP server doesn\u2019t end up being a single point of failure for IP addressing on your network. We have done this manually in the past, and sometimes it can be a challenge to set it up and get it working just the way you want it to, because the machines participating in the split scope configuration have no implicit knowledge of each other. This situation is significantly improved in Windows Server 2008 R2 with the introduction of the DHCP Split Scope Wizard. The new Split Scope Wizard makes it easy to configure split DHCP scopes among DHCP servers on your network. Included in this feature is the ability to control DHCP server responses, so that you can assign a preferred DHCP server.<\/p>\n<p>This feature is somewhat involved, and it\u2019s worth a discussion on DHCP split scopes, so I\u2019ll cover the details of the Split Scope Wizard in a future article. However, if you want to play with this now, you can find the Split Scope Wizard by right clicking on the scope you want to split, and then pointing to <strong>Advanced<\/strong> and clicking <strong>Split Scope<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"http:\/\/www.windowsnetworking.com\/img\/upl\/image0241329855153799.jpg\" width=\"461\" height=\"305\" border=\"0\" \/><br \/>\n<strong>Figure 12<\/strong><\/p>\n<h2>Summary<\/h2>\n<p>In this article, we went over some of the new and cool features included in the Windows Server 2008 R2 DHCP server. MAC filtering, options for reservations, DHCP name protection, NAP integration and the Split Scope Wizard can actually make DHCP fun again.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this article, we&#8217;ll go over some of the new and cool features included in the Windows Server 2008 R2 DHCP server. Introduction DHCP is something most IT pros take for granted. However, it wasn\u2019t really all that long ago when many of us were running local NetBEUI networks, where addressing wasn\u2019t even an issue. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57,6],"tags":[],"class_list":["post-809","post","type-post","status-publish","format-standard","hentry","category-dhcp","category-general-2008"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=809"}],"version-history":[{"count":4,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/809\/revisions"}],"predecessor-version":[{"id":2644,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/809\/revisions\/2644"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}