DHCP

Hi,
I?m not sure if I understand your question.
If a computer don't have an account in your domain, how can get an IP from your DHCP server?
I suppose that you have an Internet Server and also a firewall. You don?t have a rule to allow access only from specific IP's (a range of IP's)?
These contractors have need access to your LAN and not to Internet?

This is an awkward one; By the very nature of DHCP any machine with the client running will be able to obtain an address.

The only way you can stop unwanted clients from getting an address is by adding a reservation for every single IP address inyour DHCP range. To do this you would need the MAC address of your clients (you can use getmac.exe to do this - available on reskit and MS website). You would then assign an IP in the range to each client and exclude the extra addresses that you do not use.

There is no perfect solution but this will work; It means you will have more administration to do but at least it maintains a single point of administration.

Hope it helps.

Wayne.

If you are not worried about the contractors connecting to your LAN, you could put a proxy server in place that would ask for a password to access the internet. If you are worried about them using your LAN as well as the internet you could disconnect all jacks, except for the ones normally used in the office.

James

Just a thought, you could put the contractor machines onto a different router and disable BOOTP and DHCP relay on the router. Routers do not pass on DHCP broadcast traffic by default. You have to enable BOOTP or DHCP relay to allow machines on the other side of a router to get an IP address.

Without that, the contractors won't take one of your addresses.

Hope this helps,
Gary

Hi,
The solution of your problem is in other place. In DHCP I can't find something usefull for this issue.
How get access to the internet your workstation (also the contractors)? A server is used for this? Here you must implement some rules.

You could work-around this problem.

Since you use DHCP, anyone who connect to your network will get an IP, automatically.

You could though strip-off your gateway from DHCP. The contractor would get an IP address, but they wouldn't get the gateway IP address, or the DNS address.

But, the extra work is that for each machine in the office that need the internet, you would have to enter the DNS and gateway IP address manually.

Would this help you ?

vh_s

If you have a firewall to allow your domain users access to the internet, I would recommend utilizing a product such as Websense to force the contractors to enter a username/password for Internet access; It works great in our network

Dave

I've done some digging on the microsoft site (this problem is really annoying me)and come up with a couple of possible solutions. However both assume you're using Win2K, and I've never tried them.

The first one is User Class Support, an option that allows you to "profile" your users and assign different DHCP properties depending on the type of user. It's explained here http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/deploy/confeat/dhcpnt5.asp
The second is SuperScopes. (I know, it sounds great)Superscopes allow you to set up two scopes with different properties on the same server.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/reskit/tcpip/part2/tcpch04.asp

Either of these options should allow you to configure your legitimate clients correctly, and allow the contracors an IP address but no other confiuration.

In thinking about it, you're probably better off allowing the contractors have an IP address, otherwise all that DHCP broadcast traffic could kill your network.

Hope this one is it,
Gary

Just another thought in relation to answer 6. You could, as suggested, strip away all other configuration information from the DHCP, then create registry entries including the gateway config info. You could then run the reg files from your domain login script, ensuring that only those in your domain have access to the net.

There are some great registry tips and tricks at www.regedit.com

Hope this helps,
Gary