Principles of DHCP authorization in Windows domains

Principles of DHCP authorization in Windows domains

In a network of Windows, you can prevent illegal DHCP servers from being present by authorizing DHCP servers in domain mode. How does it work?

A DHCP server running Windows Server 2003, which detects the availability of active Directory first during startup, and then determines whether to provide DHCP services externally:

1. For servers that are joined to a domain, the DHCP server queries the list of IP addresses for the authorized DHCP servers in Active Directory. If you find your IP address in the address list, initialize and start servicing the client. If you do not find your address in the authorization list, you do not initialize and stop providing the DHCP service, which means the service does not start properly

If installed in multiple forests, the DHCP server will only seek authorization from within the forest in which they reside. Once granted, DHCP servers in multiple forest environments can lease IP addresses to all accessible clients. Therefore, if clients from other forests can access them by using routers that have the DHCP/BOOTP forwarding feature enabled, the DHCP server also leases IP addresses to them.

If Active Directory is unavailable, the DHCP server continues to run in the last known state.

2. For a DHCP server in a workgroup, when the DHCP service starts, the server broadcasts the Send DHCP message (DHCPINFORM) request package to the network to locate the root domain of the other DHCP servers that are installed and configured. This package includes several vendor-specific option types that are known and supported by other DHCP servers running Windows. When other DHCP servers receive these option types, the query and retrieval of root domain information is enabled. When queried, other DHCP servers confirm and return an answer message containing active diretory root domain information through a DHCP acknowledgment message (DHCPACK).
If the stand-alone server does not receive any response, it will start normally. If a stand-alone server receives a reply from an authorized DHCP server, the standalone server will not initialize and the DHCP service starts to terminate.

1. DHCP server in the workgroup when VS2 is started, the inform package sent

2. Authorized DHCP server in domain VS1 to respond with ACK packets

3. The client sends the Discover packet, requests the IP address

4.IP address for 192.168.10.1 Server gives a response, assigning clients to use 192.168.10.21 IP address