Hello, Cloud Gurus,
and welcome back for this demo-filled lesson
on managing Windows DHCP servers.
Let's take a look at what we're going to cover.
First up, we'll explore the DHCP management tools
and how you can get them set up.
Then we'll take a look at all
of the common DHCP management tasks
that you are likely to encounter as a hybrid administrator.
And finally, we'll wrap up
with some DHCP troubleshooting scenarios
and how you can resolve those issues
in each of the scenarios.
Let's get started.
So there are a few different management tools you can use
to manage your DHCP servers.
Let's take a look at each of these tools
and the requirements around each one.
Firstly, there is the DHCP Management Console
that you can use to manage DHCP servers.
It's installed when you use
the include management tools parameter
of Install-WindowsFeature
or you can install the remote server administration tools
DHCP feature separately.
And we did this in the demo in the previous lesson.
And for Windows PowerShell,
the DhcpServer Windows PowerShell module
is installed with the management tools.
And by default, when you install a DHCP server,
only administrators of that server
can manage the DHCP server.
And on domain controllers,
that means that only domain admins can manage DHCP.
Now, it's very likely the help desk
will require access to manage DHCP.
But we don't necessarily want them to be able
to manage the entire server
or the entire domain.
So we can use the Add-DhcpServerSecurityGroup
PowerShell cmdlet to create local groups
on the server and grant full control
and read-only access to the DHCP server
through the DHCP Administrators
and DHCP Users groups.
And if you're running DHCP on a domain controller,
this cmdlet creates domain groups
for the DHCP servers.
And you can also manage DHCP servers
through Windows Admin Center.
To manage DHCP through Windows Admin Center,
you need to enable the DHCP extension,
and because Windows Admin Center uses PowerShell
to manage the DHCP role,
you'll also need to make sure that your DHCP servers
have the DHCP management tools installed.
And you can also manage your DHCP servers
using IP Address Management or IPAM.
And IPAM offers a few advantages
over the DHCP Server Management Console,
and it's built into Server Manager.
But hold that thought though.
We'll take a look at IPAM in an upcoming lesson.
And as always, you'll likely need
to use a mix of these tools
to complete your required management tasks.
All right, let's take a look at some demos
of common DHCP management tasks
using the DHCP servers we configured
in the previous lesson.
Let's first take a look at a demo of using PowerShell
to create the DHCP management local groups
on our DHCP servers.
All right, so here we are on our administrative server
and we can add the DHCP management security groups
using the Add-DhcpServerSecurityGroup PowerShell cmdlet
and we'll specify the ComputerName,
which is CORP-BNE-DHCP01.
And then we'll repeat the process again
for CORP-BNE-DHCP02.
Now let's go ahead and use Computer Management
to take a look at the groups that are being created.
So I'll just click Start,
and then Windows Administrative Tools.
And then we'll just use Computer Management
to take a look at the local groups.
And then we'll connect to one of our DHCP servers.
So we'll right-click the Computer Management node.
Select Connect to another computer.
We'll type in the name of one of our DHCP servers.
Go ahead and click OK.
And we'll navigate into Local Users and Groups.
And then Groups.
And then we can see we have our DHCP Administrators group
and our DHCP Users group.
All right, that wraps up this demo.
Let's take a look at the next demo.
All right, now let's take a look
at configuring DHCP options.
Now, DHCP options can be configured at the server level
or the scope level or the class level.
And they take precedence in that order.
In this demo, we will configure server
and scope options
and then we'll take a look at class options
by looking at device class configuration.
Let's jump back to our administrative server
and take a look.
All right, so here we are back on our administrative server.
Let's go ahead and configure the server options
on our first DHCP server.
So we'll just navigate into the server,
then the IPv4 node, and then the Server Options node.
And we'll select that node,
right-click and then select Configure Options.
And we're going to set the DNS servers option,
so we'll just go down to option 6.
And then we'll add the IP addresses
for our DNS servers,
which are our domain controllers.
So I'll go ahead and add in 10.1.1.5 and 10.1.1.6.
Then we can go ahead and click OK.
Now all scopes configured on this DHCP server
will provide the DNS servers of 10.1.1.5 and 10.1.1.6.
Now let's go ahead
and configure some scope-specific options.
So we'll go ahead and navigate into our scope.
We'll select the Scope Options node.
And we'll right-click and select Configure Options.
And we're going to set the default gateway
for this network,
so to do that, we set the router option,
which is number 3.
And we'll set the router,
which is the default gateway for this network to 10.1.70.1.
We'll go ahead and click Add.
And then we can go ahead and click OK.
All right, now the scope is receiving both DNS servers
and the default gateway.
Now let's take a quick look at class options.
So you can use class options
to set options to apply to a specific type of device.
One example of this might be an IP phone.
Let's see how this is done.
So we'll right-click on the IPv4 node
and select Define Vendor Classes
and then we'll select Add.
And we'll type a display name for our class,
which can be VOIP Phones.
So we can declare some DHCP options
that would only apply to voice over IP phones.
And then we can define the device class
by providing an ASCII value for the vendor class.
I'm just going to enter in vendor ID.
And this would typically be some device ID
given to you by the device manufacturer.
Then we can go ahead and click OK.
We can go ahead and click Close.
And then you can create a DHCP policy
to apply specific DHCP settings to these devices.
So if I right-click Policies
and select New Policy,
and I'll just give this policy a name like VOIP Phones.
Go ahead and click Next
and then I can add a condition.
We'll say the vendor class equals VOIP Phones.
We'll go ahead and click Add.
And OK.
So this policy will only apply to VOIP Phones.
So we can go ahead and click Next.
And one typical option that you might set
on something like IP phones is option 43.
If I scroll down to option 43,
and select this Vendor Specific Info,
I could use this to provide vendor-specific information
for the IP phones.
We don't have any IP phones in our network
so I'm going to go ahead and click Cancel.
And let's take a look at the next demo.
All right, now let's take a look
at configuring scope properties,
including things like lease times
and subnet delay settings.
So we'll jump back over to our server.
All right, so here we are back on our administrative server.
Let's go ahead and right-click the Scope,
and then we'll select Properties.
And we can see that we can adjust the start
and end IP address for our IP range.
And we can change the lease duration
for our DHCP scope as well.
And we'll navigate over to Advanced
and you can see here where you can specify a subnet delay.
For example, if you're using split scopes
and you wanted a secondary server
to delay issuing IP addresses,
you could set that subnet delay here.
All right, that concludes this demo.
Let's go back and have a look at the next one.
All right, now let's take a look
at configuring server properties
to configure DNS registration
of DHCP client host names with a DNS server.
We'll jump back over to our server.
All right, now let's take a look at server properties.
So we'll right click on the IPv4 node.
And we'll select Properties.
And we'll select the DNS tab.
And we can see here
this is where we can configure our server
to automatically register DNS records
for our DHCP clients.
And then if we navigate to the Advanced tab,
this is where we can set the credentials
that our DHCP server will use
to update those DNS records.
We'll go ahead and click OK.
All right, and if we want to make sure
our device always receives the same IP address
based on its MAC address,
we can use a reservation,
so let's take a look at configuring a DHCP reservation.
We'll jump back across to our server.
All right, and if we navigate back into our scope,
and then we navigate down to Reservations,
and if we right-click on Reservations
and select New Reservation,
you can then provide a name for the reservation.
For example, we might have a printer.
And then we could make sure this printer
always receives the same IP address of 50.
And then we could provide the hardware MAC address
for this printer.
And then we can go ahead and provide a description
and it's always a good idea to provide a description
because the reservation name
will be dynamically updated
when the device first receives its reservation.
So providing a description
is something that'll always remain static.
We'll go ahead and click Close.
Let's take a look at the next demo.
Now, finally, let's configure an exclusion.
An exclusion is used to ensure that an IP address range
is not available to be used by the DHCP scope.
Let's jump across to our server and take a look.
And to configure an exclusion,
we navigate to the Address Pool,
and then right-click and select New Exclusion Range.
And then we can select
which IP addresses we'd like to exclude
and these are for devices
that are not configured to use a reservation
but instead have a static IP address assigned on the device.
And typically you'll use this
for network devices like a router.
So let's go ahead and exclude the first 10 IP addresses
in this range
by excluding the IP address range
of 10.1.70.1 to 10.1.70.10.
We'll go ahead and click Add.
And then Close.
And now those addresses have been excluded
from the IP address range.
All right, that concludes this demo.
Let's continue on.
Now, as you are working on managing DHCP,
you'll likely to have to resolve
IP address assignment issues from time to time.
Let's take a look at the top 3 issues you'll likely face
and which of the management actions you can do
to potentially resolve the issue.
The first troubleshooting task
is dealing with IP address conflicts,
and this is a situation
where a device has been configured to use an IP address
that's supposed to be leased from your DHCP scope.
And this is probably because the device
has been manually confirmed
with a static IP address.
And if you can't find and reconfigure the device,
you can reserve the IP address
of the device so it won't be leased to another device
or you can configure an exclusion.
You can also configure conflict detection
on the Advanced tab of the DHCP server properties.
Let's quickly jump back to the server
and I'll show you what I mean.
So here we are back on the server.
And if I right-click the IPv4 node,
and select Properties,
and then select Advanced,
you can see here we've got zero conflict detection attempts.
We could increase this to avoid leasing out IP addresses
that have been already statically configured on a device.
Let's continue on with the next troubleshooting task.
Another problem you'll likely face
is rogue DHCP servers.
And this is where another server
has started handing out IP addresses on your network.
Now, Windows servers are protected against this
because they won't hand out IP addresses
until they're authorized by an Enterprise Admin.
But network devices like switches and routers
don't have this protection.
To find out which DHCP server issued an IP address,
you can use the IPCONFIG /ALL command
and you can use the ARP -a command
to determine the MAC address of the rogue DHCP server,
which will allow you to find out
which port that device is plugged into
so you can locate that server and shut it down.
The final problem you'll likely face
is IP address exhaustion.
And this is where all of the IP addresses
in your scope have been used.
The DHCP server will show a blue exclamation mark
in the DHCP console when this is a problem.
To fix this issue, you can reduce the lease duration
on your scope if you have many devices joining
and leaving the network,
like laptops that are leaving behind stale leases.
And if that is not an option,
you'll need to delete and recreate the scope
as you can't change the subnet mask
for a scope once it's been created.
Now, you could create a deactivated scope
with the new settings,
and then you could deactivate the old scope
and active the new scope
for almost immediate transition to the new scope.
But all clients and network devices
that have static IP addresses
will need to have their subnet mask updated.
All right, let's take a look at what we've covered
in this lesson.
You can use the Add-DhcpServerSecurityGroup cmdlet
to create the DHCP Administrators
and DHCP Users groups on your DHCP servers.
Now, ideally these will be standalone servers,
not your domain controllers
but on a smaller network,
they may be domain groups
if that cmdlet is run against a domain controller
with the DHCP role installed.
These groups help you implement the principle
of least privilege.
It's also important to remember
that DHCP server options apply
to all scopes on the server
and DHCP scope options are scope specific.
And class options are more specific
and can be based on a device vendor
or user-defined values.
And you should use reservations to ensure a device
is leased a specific IP address.
And you can use exclusions to prevent IP addresses
from being leased where static IP addresses
are configured on devices within the address range.
And to update the subnet mask for a scope,
and allocate more addresses,
you need to delete and recreate the scope.
All right, thanks for being with me in this lesson.
I hope you found it useful
and I look forward to seeing you in the next lesson.