Windows Server · Lesson 14
Review DHCP authorization, scopes, leases, reservations, exclusions, options, interface bindings, and logs without breaking the network configuration clients depend on.
DHCP is not just an address dispenser. It can define a client's gateway, DNS servers, domain suffix, and other network behavior, so one incorrect setting can affect an entire subnet.
Lesson Snapshot
Learning objectives
Review Windows Server DHCP authorization, scopes, leases, reservations, exclusions, options, bindings, and audit logs.
Explain how DHCP fits into a domain network and why incorrect settings can disconnect many clients at once.
Use DHCP Manager, Server Manager, Event Viewer, PowerShell, and client-side tests to inspect DHCP safely.
Recognize suspicious or overly broad DHCP configuration without deleting required scopes, options, or reservations blindly.
Understand the difference between scope options, server options, reservations, exclusions, leases, and bindings.
Verify client addressing and network access after any DHCP change.
Core concepts
A range of IP addresses and related settings that a DHCP server can lease to clients on a specific network.
A temporary assignment of an IP address and DHCP options to a client.
A mapping that assigns a predictable address to a specific client, usually based on its hardware identifier.
Addresses inside a scope that the DHCP server must not lease dynamically.
Additional configuration delivered to clients, such as default gateway, DNS servers, or DNS domain name.
In Active Directory environments, DHCP servers can be authorized so domain infrastructure recognizes them as approved DHCP servers.
Core idea
Gateway and DNS options can determine whether a client can reach other networks, find the domain, and use required services.
Network warning
Incorrect gateway, DNS, exclusion, or address-range changes can disconnect an entire subnet.
Tool map
Server Manager → Tools → DHCPQuick action
Win + R → dhcpmgmt.msc
Primary GUI for reviewing DHCP servers, IPv4/IPv6 scopes, leases, reservations, options, policies, filters, and server properties.
DHCP Manager → server → IPv4 → expand the required scopeQuick action
Review Address Pool, Address Leases, Reservations, Scope Options, and Policies.
Start with the scenario-required scope before changing server-wide settings.
DHCP Manager → server → IPv4 → Server OptionsQuick action
Review settings that may apply broadly across scopes.
Server Options can affect many clients if a scope does not override them.
DHCP Manager → right-click server → PropertiesQuick action
Review bindings, DNS behavior, logging, filters, and other server-wide settings.
Server-wide changes can affect every active scope.
DHCP Manager → right-click DHCP → Manage Authorized ServersQuick action
Review approved DHCP servers in the Active Directory environment.
Do not unauthorize a required production or competition server simply because another DHCP server also appears.
Event Viewer → Applications and Services Logs → Microsoft → Windows → DHCP-ServerQuick action
Review applicable DHCP operational and admin logs.
Event evidence can help explain service, authorization, lease, and configuration problems.
C:\Windows\System32\dhcpQuick action
Review DHCP audit log files when audit logging is enabled.
Audit logs can contain lease and server activity useful for investigation.
Start → search PowerShell → Run as administrator when requiredQuick action
Use Get-DhcpServer* cmdlets for read-only inspection.
PowerShell is especially useful for fast scope, option, lease, reservation, and binding inventory.
Scope review
What subnet does this scope serve?
What is the start and end address of the pool?
Which addresses are excluded from dynamic leasing?
Are any important systems using reservations?
What lease duration is configured?
Which default gateway is supplied to clients?
Which DNS servers are supplied to clients?
Which DNS domain name is supplied?
Are any policies changing options for selected clients?
How will a client obtain or renew a lease after the change?
Server review
Is this DHCP server authorized in Active Directory when authorization is part of the environment?
Which network interfaces is DHCP bound to?
Is the DHCP Server service running?
Are audit logs enabled?
Are filters being used?
Are there multiple scopes and are all of them required?
Are server-level options configured?
Does DHCP update DNS records on behalf of clients?
Are failover or relay relationships part of the network design?
Which client-side tests prove DHCP is working correctly?
Common DHCP options
Option 003
Provides the default gateway clients use to reach other networks.
An incorrect gateway can strand clients on the local subnet.
Option 006
Provides the DNS resolvers clients should use.
Incorrect DNS can break domain logon, Group Policy, and ordinary name resolution.
Option 015
Provides the DNS suffix or domain name used by clients.
An incorrect suffix can cause confusing name-resolution and domain behavior.
Option 044 / 046
May appear in older environments that still use NetBIOS name services.
Do not add or remove legacy options without understanding the environment that depends on them.
PowerShell inspection
Get-Service -Name "DHCPServer"Shows whether the DHCP Server service is running.
Get-DhcpServerInDCShows DHCP servers authorized in Active Directory when the cmdlet and domain context are available.
Get-DhcpServerv4Scope | Select-Object ScopeId, Name, State, StartRange, EndRange, SubnetMask, LeaseDurationCreates a read-only inventory of IPv4 scopes.
Get-DhcpServerv4Lease -ScopeId "10.0.10.0" | Select-Object IPAddress, HostName, ClientId, AddressState, LeaseExpiryTimeShows leases for a selected scope. Replace the example ScopeId with the authorized scope.
Get-DhcpServerv4Reservation -ScopeId "10.0.10.0" | Select-Object IPAddress, ClientId, Name, DescriptionLists reservations for a selected scope.
Get-DhcpServerv4OptionValue -ScopeId "10.0.10.0"Shows DHCP options configured at the selected scope.
Get-DhcpServerv4OptionValueShows server-level DHCP option values.
Get-DhcpServerv4BindingShows which network interfaces DHCP is bound to.
Get-DhcpServerv4StatisticsShows useful DHCP server statistics such as addresses in use and available.
Address pool logic
Define which addresses the scope can potentially lease.
Protect addresses inside the subnet that should not be leased dynamically, such as statically configured infrastructure.
Provide predictable addresses to known clients without manually configuring the client itself.
The usable dynamic pool is the configured range minus exclusions and reserved or currently leased addresses.
Authorization
In an Active Directory environment, an authorized DHCP server is recognized as approved to provide DHCP service.
An unknown DHCP server can create conflicting network configuration, but do not assume every additional authorized server is malicious.
Multiple authorized DHCP servers can be legitimate when scopes, failover, or network design require them.
Compare authorized servers with scenario documentation and network design before removing authorization.
DHCP and DNS
Clients may register their own DNS records depending on configuration.
DHCP can be configured to update DNS records for clients, which creates a dependency between DHCP and DNS.
Some environments use dedicated credentials for secure dynamic DNS updates.
DHCP lease changes can affect DNS records, so scavenging and update behavior should be reviewed together.
Suspicious signals
A scope option pointing clients to an unexpected router can redirect traffic or break connectivity.
An unknown DNS resolver in Option 006 can redirect queries and break domain behavior.
Two active scopes serving the same addresses can create conflicts and unpredictable client configuration.
A reservation for an unknown client may be legitimate, stale, or suspicious and should be investigated.
The server may be listening on a network where it should not provide leases.
Repeated conflicts can indicate duplicate static addressing, rogue DHCP behavior, or another network problem.
Troubleshooting
Symptom
Check
Confirm the DHCP Server service, active scope, available addresses, server authorization, interface binding, relay path if used, firewall/network reachability, and client request behavior.
Symptom
Check
Review Option 003 Router, subnet mask, VLAN/relay path, client route table, and whether the gateway address is valid for the scope.
Symptom
Check
Review Option 006 DNS Servers and Option 015 DNS Domain Name. Domain clients should use the intended internal DNS infrastructure.
Symptom
Check
Review lease utilization, exclusions, reservations, stale leases, scope size, and whether the subnet design is correct.
Symptom
Check
Another administrator, failover partner, automation, configuration-management tool, or imported configuration may be restoring them.
Symptom
Check
Review the specific scope, DHCP relay/IP helper path, interface binding, VLAN routing, and scope options for the failing network.
Lease states
The client currently holds a valid lease.
The lease is no longer valid and the address may become available for reuse.
The address is tied to a specific client identity and should not be treated like an ordinary dynamic lease.
Windows DHCP may mark an address bad when conflict detection identifies another device already using it.
Filters and policies
Can restrict service to approved client identifiers in environments that use filtering.
Can block selected clients from receiving leases.
Can provide different options or behavior to selected clients based on conditions.
Filters and policies can explain why one client behaves differently from another, so inspect them before assuming the scope is broken.
Client verification
ipconfig /allShows whether the client obtained its address, gateway, DNS servers, DHCP server, lease times, and DNS suffix as expected.
ipconfig /releaseReleases the current DHCP lease. Use only on an authorized test client because connectivity will temporarily drop.
ipconfig /renewRequests a new or renewed DHCP lease from the authorized DHCP infrastructure.
ipconfig /allConfirm the default gateway matches the expected scope configuration.
ipconfig /allConfirm the client is using the intended internal DNS servers.
Resolve-DnsName example.localConfirms DHCP-provided DNS configuration supports required domain name resolution.
Change discipline
Read the scenario and identify required subnets.
Record scope ranges, exclusions, reservations, and options.
Record DHCP authorization and interface bindings.
Check current leases and active clients before disruptive changes.
Identify DHCP-DNS integration dependencies.
Change one scope or server setting at a time.
Avoid deleting reservations or exclusions without confirming ownership.
Avoid changing the default gateway or DNS options blindly.
Renew a lease from an authorized test client.
Verify address, gateway, DNS, and domain connectivity after changes.
Decision cases
Option 006 contains the required internal DNS server plus one undocumented address.
The second resolver may be unauthorized, stale, or part of a legitimate redundancy design.
Response
Identify the second server, compare it with the authorized network design, test current client behavior, then remove it only if it is clearly unnecessary or incorrect.
A major portion of the scope is excluded from leasing.
The exclusion may protect static infrastructure or may unnecessarily shrink the pool.
Response
Map the excluded addresses to known servers, network devices, and reservations before changing the exclusion range.
A reserved address is tied to a client identifier not listed in the scenario.
It may belong to an infrastructure device, printer, server, or old client.
Response
Check hostname, lease history, DNS records, device ownership, and scenario requirements before deleting the reservation.
Get-DhcpServerInDC returns two authorized servers.
A second server may be legitimate for redundancy, another site, or failover.
Response
Verify the network design and scope ownership before changing authorization.
Fictional defensive lab
Step 01
DHCP-SRV provides addresses for the 10.20.30.0/24 client network. Clients must use 10.20.30.1 as the gateway and DC-PRACTICE as their internal DNS server.
Step 02
Open DHCP Manager and use PowerShell to record authorization, interface bindings, scopes, statistics, and the DHCP service state.
Step 03
Inspect Address Pool, exclusions, leases, reservations, Scope Options, and any policies.
Step 04
The scope includes an undocumented second DNS server and a reservation for an unknown device. A large exclusion range also exists.
Step 05
Preserve required static infrastructure and reservations, remove only clearly unauthorized option values or entries, and keep the client pool large enough for the scenario.
Step 06
Release and renew an authorized test client lease, then confirm the expected IP range, gateway, DNS server, DNS suffix, and domain resolution.
Common mistakes
Reservations often belong to printers, servers, appliances, or other required infrastructure.
Domain clients can lose authentication and Group Policy functionality when given the wrong DNS resolver.
The excluded addresses may be statically assigned to routers, servers, or network devices.
Multiple authorized servers can be legitimate in multi-site or redundant designs.
The server can look healthy while clients still receive bad options or fail to reach the network.
A secure configuration still fails if the address pool is exhausted.
Reflection
Question 1
Why can an incorrect DHCP DNS option break Active Directory behavior?
Question 2
Why should a large exclusion range be investigated before being removed?
Question 3
Why can multiple authorized DHCP servers be legitimate?
Question 4
What is the difference between a reservation and a dynamic lease?
Question 5
Why should DHCP filters and policies be checked when one client behaves differently from another?
Question 6
What should be verified on a client after changing DHCP settings?
Verification checklist
The DHCP Server service is running.
The server is authorized when domain authorization is part of the design.
Required scopes are active.
Address pools and exclusions match the intended subnet design.
Required reservations remain intact.
Default gateway options are correct.
DNS server and DNS domain options are correct.
DHCP bindings match the intended interfaces.
Authorized clients can obtain or renew leases.
Clients can reach required networks and resolve required domain names.
Competition checklist
Open DHCP Manager or dhcpmgmt.msc.
Review authorized DHCP servers.
Review IPv4 scopes.
Review Address Pool and exclusions.
Review Address Leases.
Review Reservations.
Review Scope Options.
Review Server Options.
Review interface bindings.
Review filters and policies when present.
Check DHCP audit/Event Viewer logs.
Verify from an authorized client with ipconfig /all and lease renewal.
Next Windows Server lesson
Next, review scheduled tasks, triggers, actions, run-as identities, task history, unusual execution paths, and the difference between legitimate automation and suspicious persistence.