Best Practices Analyzer for Dynamic Host Configuration Protocol: Configuration

Applies To: Windows Server 2008 R2

Topics in this section can help you bring DHCP that is running on Windows Server® 2008 R2 into compliance with configuration best practices. Content in this section is most valuable to administrators who have completed a Best Practices Analyzer scan of DHCP, and who want information about how to interpret and resolve scan results that identify areas of DHCP that are noncompliant with configuration best practices.

Best Practices Analyzer and configuration rules

Configuration rules are applied to identify settings that might require modification for DHCP to perform optimally. Configuration rules can help prevent setting conflicts that can result in error messages or prevent DHCP from carrying out its prescribed duties in an enterprise.

For more information about Best Practices Analyzer and scans, see Best Practices Analyzer.

Topics in this section

• DHCP: Rogue detection should be enabled

• DHCP: The server should be authorized

• DHCP: The server should have at least one IPv4 scope

• DHCP: The server should have at least one IPv6 scope or server option configured

• DHCP: An IP address range should be defined for all scopes

• DHCP: All IPv4/IPv6 configured scopes should be active

• DHCP: IP address conflict detection should have a value of less than 4

• DHCP: The server IPv4 address should be excluded from all scopes

• DHCP: The server IPv6 address should be excluded from all scopes

• DHCP: Audit logging should be enabled

• DHCP: If the allow list is enabled, MAC address filtering should be populated

• DHCP: The MAC address filtering configuration should not block IP address reservations

• DHCP: The server should be configured to send its default gateway to all clients

• DHCP: The server should be configured to register DNS records on behalf of DHCPv4 clients

• DHCP: The server should be configured to register DNS records on behalf of DHCPv6 clients

• DHCP: The DNS server option should be configured for all IPv4 scopes

• DHCP: The DNS server option should be configured for all IPv6 scopes

• DHCP: The IPv4 addresses of the DNS server should be reachable

• DHCP: The IPv6 addresses of the DNS server should be reachable

• DHCP: The DNS domain option should be configured as a scope or server option for DHCPv4

• DHCP: The DNS domain option should be configured as a scope or server option for DHCPv6

• DHCP: A forward lookup zone should be configured for the DNS domain used to register DNS records for IPv4 clients

• DHCP: A forward lookup zone should be configured for the DNS domain used to register DNS records for IPv6 clients

• DHCP: Secure DNS updates should be configured if Name Protection is enabled on any IPv4 scope

• DHCP: Secure DNS updates should be configured if Name Protection is enabled on any IPv6 scope

• DHCP: Credentials for DNS update should be configured if secure dynamic DNS update is enabled and the domain controller is on the same host as the DHCP server

• DHCP: The DNSupdateproxy group must be secured if Name Protection is enabled on any IPv4 scope

See Also

Concepts

Best Practices Analyzer for Dynamic Host Configuration Protocol: Prerequisites
Best Practices Analyzer for Dynamic Host Configuration Protocol: Operation
Best Practices Analyzer for Dynamic Host Configuration Protocol: Security