DHCP auto assigns IP address to local log on

[whittier]

Windows 2000 server assigns a dynamic address to non network users who bring their own laptops into my building and plug into an active jack. Once plugged in the user can log on using local authentication and receive an IP address from my DHCP server. I want to stop DHCP from assigning an IP address to a non network user logging on locally to their own machine.

 

[dbase77]

Hi,

How many desktop pc do you have that use dhcp from win2000?

regards,
feroz

 

[whittier]

My network supports 5000 users

 

[dbase77]

Hi,

It doesnt matter how many users you have. What matter is how many machine that you have. If you have less machine, I suggest you use static dhcp ip base on machine NIC mac address and only limit no. of ip you want to use.

regards,
feroz

 

[whittier]

I have 5000 desktops. I understand what you are saying, however I would like to know if there is a way to preclude Microsoft windows 2000 DHCP from granting an IP address to a machine that logs on locally.

 

[dbase77]

Hi,

Not from my experience. But if you can gather all the mac addresses for your desktop (takes time), you can write some sort of script for authentication. Put mac address list on database and search through it every minute or so. If not on the list, kill it.

regards,
feroz

 

[whittier]

Thank you Feroz, I hope I do not have to do this. Microsoft must have a workaround or some sort of solution, though I have not seen it on knowledgebase

 

[BOKA]

As far as I know, you cannot prevent DHCP address assignment any other way, except for using MAC address database, just like DBASE77 stated.
Reason is a client sends DHCP request during TCP/IP initialization, which happens before a system can be defined as "local" or "visiting".

Good luck.

 

[PcLinuxGuru]

UNfortunately I ran into the same problems with the laptops. I basically switched to Unix for DHCP and authroized DHCP based on hostname. But that doesn't stop someone from running ipconfig and getting the info they need. I had someone knock down my network because they statically assigned the router IP to their machine. So the best thing is too get management involved if plugging in laptos is not allowed.

 

[tcambridge]

Unfortunately, this is one of the features most desired in DHCP. However, you can use port security on your switches to disable any ports that are not in use. This will save you the hassle of tracking down MAC addresses and modifying the DHCP scopes whenever you have a new NIC on the block. Most network management tools have a web browser interface where you can simply click on the port that you want to enable/disable and it takes effect immediately.

Tim Cambridge
A+, CCNA, MCSA, MCSE (W2K)