Recipe14.19.Running DHCP Server on a Domain Controller

Recipe 14.19. Running DHCP Server on a Domain Controller

Problem

You want to run the DHCP Server service on a domain controller. It is not recommended that you run DHCP on a domain controller unless you modify the DHCP Server configuration to use alternate credentials when making dynamic DNS updates. This recipe explains how.

Solution

Using a graphical user interface

1. Open the DHCP snap-in.

2. In the left pane, right-click on DHCP and select Add Server.

3. Type in the name of the DHCP Server you want to target and click OK.

4. Right-click the server and select Properties.

5. Click the Advanced tab.

6. Click the Credentials button.

7. Enter the username, domain, and password for the account you want to use.

8. Click OK until all dialog windows are closed.

Using a command-line interface

Use the following command to display the current DNS credentials used by the DHCP Server:

> netsh dhcp server show dnscredentials

Use the following command to configure new DNS credentials on the DHCP Server:

> netsh dhcp server set dnscredentials <Username> <Domain> <Password>

Use the following command to remove the DNS credentials used by the DHCP Server:

> netsh dhcp server delete dnscredentials dhcpfullforce

Using VBScript

See the Introduction for more information on how to run the netsh command from within a script.

Discussion

By default, the DHCP Server runs under the credentials of the computer account that is hosting it. If it happens to be running on a domain controller, it runs under the domain controller's computer account. A domain controller has full permissions over any Active Directory-integrated zones it replicates. The result of the DHCP Server running on a domain controller means that if the DHCP Server has been configured to dynamically register DNS records on behalf of clients, it can potentially update any record stored in an Active Directory-integrated zone. Ultimately, that leaves the zones vulnerable to name hijacking, whereby a client can cause records to be overwritten that shouldn't be. This can cause all sorts of havoc if an attacker starts replacing important records in your zones.

Microsoft recommends that you avoid this completely by not running the DHCP Server on a domain controller. But as of Windows 2000 Service Pack 1, you can work around this issue by configuring the DHCP Server to use alternate credentials when making dynamic updates. The account doesn't need any special permissions in order to dynamically update records. After you've configured alternate credentials, check the event log for any errors pertaining to logon issues (perhaps the username or password are incorrect) or dynamic update errors.

If you back up a DHCP Server's configuration using NTBackup, DNS credentials are not backed up. This is done intentionally to prevent someone from hijacking names by restoring a DHCP Server from backup. You must manually restore the DNS credentials if you have to restore a DHCP Server.

See Also

Recipe 14.14 and MS KB 255134 (Installing Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) on a Domain Controller)