Limit DHCP

I don't really understand question.

If you wish to assign static IP addresses to certain users in a domain with DHCP, you may do so.

Stopping a PC from obtaining an IP address via DHCP is another issue and I'll pass that along to one of our network gurus. Other than removing the connection, I don't know of any way.

Dalton

I don't believe Windows 2000 Server has any native ability to limit DHCP clients.

You would have to resort to managing DHCP access through managed networking, I would think. Routers, switches and firewalls can control access to network protocols and services.

I would use a domain for valid logon and some sort of proxy server that requires user authentication thus regardless of user if they do not have valid credentials they would not have access to the internet unless validated, this can be achieved using a few alternatives,Group Policy or AD whereby if either the user or the Laptop itself is not part of the domain users/computers respectively then although obtaining a valid IP from the DHCP server, they are not authenticated through your proxy.

hope this helps

regards

Matmak

>> I don't believe Windows 2000 Server has any native ability to limit DHCP clients.

You would have to resort to managing DHCP access through managed networking, I would think. Routers, switches and firewalls can control access to network protocols and services. <<

Comment from aaron_ferra@... on 02/23/05:
>Is there some stuff for adding the ability to limit DHCP clients to a list of MAC adresses? <

To Windows 2000 Server? Not that I know of. Sorry. You're probably still looking at managed networking devices or software.

You can prevent your DHCP Server from giving out any Addresses if you make the entire subnet an excluded range, then make reservations for all of your existing Workstations. This would give you the flexibility of DHCP management, and is a step up from giving out static IP's.
But in reality anyone plugging into your network could guess or sniff and assign themselves a static ip and they?re on.

If you're trying to prevent just Internet access, answer 3 is correct by suggesting that the use of a proxy server that requires authentication would be a solution. If Network security is your biggest concern, you may seriously want to consider using Certificates/IPSEC for all server/workstation communication.
Answer 1 was correct about disconnecting unused ports. If a port in not in use, just unplug it from the HUB/switch until it is needed.
One friend of mine had a creative solution to prevent unauthorized access, he punched down the jacks in a different order. This way anyone that wants access has to get a custom patch cord from him first.

You also may also want to consider a DHCP Quarantine strategy
http://tinyurl.com/5c6dv

Here is what I did. It works effectively.
I created a scope from x.x.x.0 to x.x.x.254
I the excluded the entire range.
I created reservations for our servers and routers which have a ststic IP
I then made a reservation for each workstation's MAC address. The workstations are always assigned that particular IP which comes in handy when trying to solve problems.
When laptops plug in, they are excluded from the DHCP server. It's not foolproof but it has worked well for us.

merv