DHCP Installation

            DHCP 

How do I... Install and configure a DHCP server in Windows Server 2008?

Dynamic Host Configuration Protocol (DHCP) is an invaluable service when you have a network larger than a handful of computers. It’s also a standard component of enterprise networks and sub networks. Microsoft Windows Server 2008’s built-in DHCP server allows Windows machines (and any other TCP/IP-based machines and devices) to obtain their IP addresses and network settingsautomatically, which can vastly simplify network configuration. In this document, we’ll discuss how to install and configure a DHCP server in Windows Server 2008, and we’ll explore some of the advanced features DHCP has to offer.

Create a plan

Before you configure your DHCP server, it is a good idea to have all your ducks in a row. Prepare and have all the necessary information up front before sitting down and configuring your server. For example, you may need to know:

• The scope of IP addresses that your server will manage (e.g., 192.168.1.50 to 192.168.1.200).
• Which machines require static IP addresses (i.e., those machines such as servers and routers that will not use DHCP to receive their IP addresses but will be set manually).
• Which network information you want to send out to DHCP clients when they get their IP addresses (e.g., the addresses for your default gateway, DNS servers, and WINS servers).

It is much easier to configure your DHCP server with this information in hand rather than scrambling for it at implementation time.

Installing DHCP

Installing a DHCP server in Windows 2008 is a snap. They created a very simple wizard that walks you through the entire process. Follow me on this journey.

To install a DHCP server from the Control Panel, follow these steps:

1. From the Start menu, select | Control Panel | Administrative Tools | Server Manager.
2. Expand and click Roles (Figure A).
3. Choose Add Roles and follow the wizard by selecting the DHCP role (Figure B).
4. A new DHCP wizard appears to help you configure a DHCP server.

Figure A

Server Manager

Figure B

Add Roles Wizard

In the previous release of Windows, a wizard did not appear to walk you through creating a DHCP server. Windows Server 2008 has really simplified this process by allowing you to configure a DHCP server in roughly seven steps. Of course, you can still manage your DHCP server from the DHCP Microsoft Management Console (MMC) snap-in or delete and create scopes on the fly.

Let’s continue on through the wizard. Your network cards and static IP addresses are automatically detected and you can choose how DHCP will service clients on different subnets, as shown inFigure C.

Figure C

Choose your static IP addresses to service DHCP clients

On the next window (Figure D), you can specify the applicable DNS server(s) to be used with DHCP when an address is assigned. Figure E displays where you would enter the applicable WINS servers if you require it on your network.

Figure D

Enter your DNS server IP address

Figure E

Enter your WINS server IP address

About scopes

When you create a scope, you must select the range of IP addresses and you must specify the appropriate scope options to include. These options are what we were referring to above when we mentioned that you can assign other network information to your clients at the time they are given an IP address.

There are two types of scope options: Global and Scope. Global options are propagated to all the scopes that you create on that DHCP server, while Scope options are only for the individual scope that you are working with.

For example, if you have different scopes for several different subnets and each subnet will have a different default gateway but will share the same DNS servers, you would want to set the DNS servers as a Global option while the default gateways would be set separately in each scope as a Scope option.

On the DHCP scope window, you will create your scope. Depending on the size of your network and the amount of users that will be assigned IP addresses, some thought must be given to the parameters of your scope selections. In my example (Figure F), I created a simple scope.

Figure F

Creating your scope

The subnet type dropdown allows you to choose wireless as well (Figure G). It defaults to 24 hours. If you want to activate the scope when the wizard is complete, click the Activate this scope checkbox. If you leave it empty, you must activate the scope in the DHCP Microsoft Management Console (MMC) snap-in.

Figure G

You can add multiple scopes before continuing the wizard

With Windows Server 2008, if you have a router (Figure H) that supports and is configured to take advantage of IPv6, you can enable this functionality on your network.

Figure H

Enable IPv6 stateless mode

Authorizing the DHCP server and activating scopes

In previous versions of Windows Server, you had to install and configure your DHCP server and then authorize it in the DHCP MMC snap-in. Authorizing your DHCP server allows you to prevent hackers from configuring rogue DHCP servers. In Windows Server 2008, you have the ability to either authorize the server in the Wizard or authorize it after the fact in the DHCP MMC-snap-in (Figure I).

Figure I

Authorizing your DHCP server

You are now ready to review (Figure J) and confirm your settings before applying your DHCP settings (Figure K).

Figure J

Reviewing your DHCP configuration before applying

Figure K

DHCP installation in progress

Once you have installed the DCHP server, you can manage it from the DHCP MMC snap-in (Figure O) located in Administrative tools. On this screen you can create additional exclusions and reservations.

Adding reservations

In addition to specifying exclusions, you can add reservations to your DHCP server. By adding a reservation, you ensure that a machine always receives the same IP address from the DHCP server.

1. Right-click on Reservations and choose new reservation.
2. Enter a friendly name for the reservation and the IP address you want to assign to the computer or device.
3. Enter the MAC address of the computer or device. (For Windows machines, you can find the MAC address by running ipconfig/all from the command prompt of the machine.)
4. Enter a description and then choose the following reservation type: DHCP, BOOTP (going across a router), or both, as shown in Figure L. Click Add.

Figure L

Adding a reservation

Adding exclusions

In addition to specifying reservations, you can add exclusions to your DHCP server (Figure M). By adding exclusions, you ensure that machines never receive a DHCP lease for that range of IP addresses. This is very useful to block IP addresses for your servers and routers.

Figure M

Adding an exclusion

In order to add Exclusions, right-click on Address Pools and choose New Exclusion Range as shown in Figure N and Figure O.

Figure N

IP address Exclusion range

Figure O

DCHP MMC snap-in

Troubleshooting DHCP

After configuring DHCP, the easiest way to troubleshoot it is to use Ipconfig from a command prompt. To view all TCP/IP information on a machine just type ipconfig/all. To release a DHCP lease, type ipconfig/release; to renew a lease, type ipconfig/renew.

DNS INSTALLATION

How do I... Install and configure a DNS server in Windows Server 2008?

.

Installation

You can install a DNS server from the Control Panel or when promoting a member server to a domain controller (DC) (Figure A). During the promotion, if a DNS server is not found, you will have the option of installing it.

Figure A

Domain controller

To install a DNS server from the Control Panel, follow these steps:

• From the Start menu, select | Control Panel | Administrative Tools | Server Manager.
• Expand and click Roles (Figure B).
• Choose Add Roles and follow the wizard by selecting the DNS role (Figure C).
• Click Install to install DNS in Windows Server 2008 (Figure D).

Figure B

Expand and click Roles

Figure C

DNS role

Figure D

Install DNS

DNS console and configuration

After installing DNS, you can find the DNS console from Start | All Programs | Administrative Tools | DNS. Windows 2008 provides a wizard to help configure DNS.

When configuring your DNS server, you must be familiar with the following concepts:

• Forward lookup zone
• Reverse lookup zone
• Zone types

A forward lookup zone is simply a way to resolve host names to IP addresses. A reverse lookup zone allows a DNS server to discover the DNS name of the host. Basically, it is the exact opposite of a forward lookup zone. A reverse lookup zone is not required, but it is easy to configure and will allow for your Windows Server 2008 Server to have full DNS functionality.

When selecting a DNS zone type, you have the following options: Active Directory (AD) Integrated, Standard Primary, and Standard Secondary. AD Integrated stores the database information in AD and allows for secure updates to the database file. This option will appear only if AD is configured. If it is configured and you select this option, AD will store and replicate your zone files.

A Standard Primary zone stores the database in a text file. This text file can be shared with other DNS servers that store their information in a text file. Finally, a Standard Secondary zone simply creates a copy of the existing database from another DNS server. This is primarily used for load balancing.

To open the DNS server configuration tool:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Highlight your computer name and choose Action | Configure a DNS Server… to launch the Configure DNS Server Wizard.
3. Click Next and choose to configure the following: forward lookup zone, forward and reverse lookup zone, root hints only (Figure E).
4. Click Next and then click Yes to create a forward lookup zone (Figure F).
5. Select the appropriate radio button to install the desired Zone Type (Figure G).
6. Click Next and type the name of the zone you are creating.
7. Click Next and then click Yes to create a reverse lookup zone.
8. Repeat Step 5.
9. Choose whether you want an IPv4 or IPv6 Reverse Lookup Zone (Figure H).
10. Click Next and enter the information to identify the reverse lookup zone (Figure I).
11. You can choose to create a new file or use an existing DNS file (Figure J).
12. On the Dynamic Update window, specify how DNS accepts secure, nonsecure, or no dynamic updates.
13. If you need to apply a DNS forwarder, you can apply it on the Forwarders window. (Figure K).
14. Click Finish (Figure L).

Figure E

Configure

Figure F

Forward lookup zone

Figure G

Desired zone

Figure H

IPv4 or IPv6

Figure I

Reverse lookup zone

Figure J

Choose new or existing DNS file

Figure K

Forwarders window

Figure L

Finish

Managing DNS records

You have now installed and configured your first DNS server, and you’re ready to add records to the zone(s) you created. There are various types of DNS records available. Many of them you will never use. We’ll be looking at these commonly used DNS records:

• Start of Authority (SOA)
• Name Servers
• Host (A)
• Pointer (PTR)
• Canonical Name (CNAME) or Alias
• Mail Exchange (MX)

Start of Authority (SOA) record

The Start of Authority (SOA) resource record is always first in any standard zone. The Start of Authority (SOA) tab allows you to make any adjustments necessary. You can change the primary server that holds the SOA record, and you can change the person responsible for managing the SOA. Finally, one of the most important features of Windows 2000 is that you can change your DNS server configuration without deleting your zones and having to re-create the wheel (Figure M).

Figure M

Change configuration

Name Servers

Name Servers specify all name servers for a particular domain. You set up all primary and secondary name servers through this record.

To create a Name Server, follow these steps:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Expand the Forward Lookup Zone.
3. Right-click on the appropriate domain and choose Properties (Figure N).
4. Select the Name Servers tab and click Add.
5. Enter the appropriate FQDN Server name and IP address of the DNS server you want to add.

Figure N

Name Server

Host (A) records

A Host (A) record maps a host name to an IP address. These records help you easily identify another server in a forward lookup zone. Host records improve query performance in multiple-zone environments, and you can also create a Pointer (PTR) record at the same time. A PTR record resolves an IP address to a host name.

To create a Host record:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Expand the Forward Lookup Zone and click on the folder representing your domain.
3. From the Action menu, select New Host.
4. Enter the Name and IP Address of the host you are creating (Figure O).
5. Select the Create Associated Pointer (PTR) Record check box if you want to create the PTR record at the same time. Otherwise, you can create it later.
6. Click the Add Host button.

Figure O

A Host (A) record

Pointer (PTR) records

A Pointer (PTR) record creates the appropriate entry in the reverse lookup zone for reverse queries. As you saw in Figure H, you have the option of creating a PTR record when creating a Host record. If you did not choose to create your PTR record at that time, you can do it at any point.

To create a PTR record:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Choose the reverse lookup zone where you want your PTR record created.
3. From the Action menu, select New Pointer (Figure P).
4. Enter the Host IP Number and Host Name.
5. Click OK.

Figure P

New Pointer

Canonical Name (CNAME) or Alias records

A Canonical Name (CNAME) or Alias record allows a DNS server to have multiple names for a single host. For example, an Alias record can have several records that point to a single server in your environment. This is a common approach if you have both your Web server and your mail server running on the same machine.

To create a DNS Alias:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Expand the Forward Lookup Zone and highlight the folder representing your domain.
3. From the Action menu, select New Alias.
4. Enter your Alias Name (Figure Q).
5. Enter the fully qualified domain name (FQDN).
6. Click OK.

Figure Q

Alias Name

Mail Exchange (MX) records

Mail Exchange records help you identify mail servers within a zone in your DNS database. With this feature, you can prioritize which mail servers will receive the highest priority. Creating MX records will help you keep track of the location of all of your mail servers.

To create a Mail Exchange (MX) record:

1. Select DNS from the Administrative Tools folder to open the DNS console.
2. Expand the Forward Lookup Zone and highlight the folder representing your domain.
3. From the Action menu, select New Mail Exchanger.
4. Enter the Host Or Domain (Figure R).
5. Enter the Mail Server and Mail Server Priority.
6. Click OK.

Figure R

Host or Domain

Other new records

You can create many other types of records. For a complete description, choose Action | Other New Records from the DNS console (Figure S). Select the record of your choice and view the description.

Figure S

Create records from the DNS console

Troubleshooting DNS servers

When troubleshooting DNS servers, the nslookup utility will become your best friend. This utility is easy to use and very versatile. It’s a command-line utility that is included within Windows 2008. With nslookup, you can perform query testing of your DNS servers. This information is useful in troubleshooting name resolution problems and debugging other server-related problems. You can access nslookup (Figure T) right from the DNS console.

Figure T

Nslookup utility

Domain Controller 2008

INSTALLING DOMAIN CONTROLLER IN WINDOWS 2008 SERVER

Considerations when Installing a new Windows Server 2008 forest

When you install AD to create the first domain controller in a new Windows Server 2008 forest, you must keep the following considerations in mind:

• You must make forest and domain functional level decisions that determine whether your forest and domain can contain domain controllers that run Windows 2000 Server, Windows Server 2003, or both. To read more about forest and domain functional levels please refer to the links below.
• Domain controllers running the Microsoft Windows NT Server 4.0 operating system are NOT supported with Windows Server 2008.
• Servers running Windows NT Server 4.0 are NOT supported by domain controllers that are running Windows Server 2008, meaning you MUST have additional DCs running Windows 2000/2003 to support older NT 4.0 servers.
• The first Windows Server 2008 domain controller in a forest must be a global catalog server and it cannot be an RODC.

Considerations when Installing a new Windows Server 2008 domain in an existing Windows 2000/2003 forest

When you install AD to create the first domain controller in a new Windows Server 2008 domain, you must keep the following considerations in mind:

• Before you create a new Windows Server 2008 domain in a Windows 2000/2003 forest, you must prepare the forest for Windows Server 2008 by extending the schema (that is, by running ADPREP /forestprep). To read more about ADPREP please refer to the links below or my "Windows Server 2008 ADPREP" article.
• You must make domain functional level decisions that determine whether your domain can contain domain controllers that run Windows 2000 Server, Windows Server 2003, or both. To read more about forest and domain functional levels please refer to the links below.
• I recommend that you host the PDC emulator operations master role in the forest root domain on a domain controller that runs Windows Server 2008. For more information about FSMO Roles, please read my "Understanding FSMO Roles in Active Directory" and "Transferring FSMO Roles" articles.

General considerations

Make sure you read and follow the requirements described in my "Active Directory on Windows Server 2008 Requirements" article.

Installing Active Directory Domain Services (AD-DS)

In Windows Server 2008, unlike previous server operating Systems, there is an additional step that needs to be taken before running DCPROMO to promote the server to Domain Controller and installing Active Directory on it. This step is the installation of Active Directory Domain Services (AD-DS) role on the server. In fact, the AD-DS role is what enables the server to act as a Domain Controller, but you will still need to run DCPROMO the regular way.

AD-DS can be installed in one of 3 methods:

Method 1 – Server Manager/Initial Configuration Tasks

Roles can and should be added from Server Manager (but they can also be initiated from the Initial Configuration Tasks wizard that auto-opens the first time you log on to the server).

1. Open Server Manager by clicking the icon in the Quick Launch toolbar, or from the Administrative Tools folder.
2. Wait till it finishes loading, then click on Roles > Add Roles link.

1. In the Before you begin window, click Next.

1. In the Select Server Roles window, click to select Active Directory Domain Services, and then click Next.

1. In the Active Directory Domain Services window read the provided information if you want to, and then click Next.

1. In the Confirm Installation Selections, read the provided information if you want to, and then click Next.

1. Wait till the process completes.

1. When it ends, click Close.

1. Going back to Server Manager, click on the Active Directory Domain Services link, and note that there's no information linked to it, because the DCPROMO command has not been run yet.

1. Now you can click on the DCPROMO link, or read on.
   1. To run DCPROMO, enter the command in the Run command, or click on the DCPROMO link from Server Manager > Roles > Active Directory Domain Services.
   
   1. Depending upon the question if AD-DS was previously installed or not, the Active Directory Domain Services Installation Wizard will appear immediately or after a short while. Click Next.
   

Install AD

This article was written when Windows Server 2008 was still RC1. Changes might occur later once the product is RTM'd

1. If you have set up a domain controller previously with Windows 2000 Server, or Windows Server 2003, then you would be familiar with thedcpromo.exe command, it will also be used to set up a Domain Controller on Windows Server 2008. 
   
   To use the command, click on Start  > Run > and then write dcpromo > Click OK
   
   
2. The system will start checking if Active Directory Domain Services ( AD DS) binaries are installed, then will start installing them. The binaries could be installed if you had run the dcpromo command previously and then canceled the operation after the binaries were installed.
   
                            
   
3. The Active Directory Domain Services Installation Wizard will start, either enable the checkbox beside Use Advanced mode installationand Click Next , or keep it unselected and click on Next
   
   
   
   
   The following table lists the additional wizard pages that appear for each deployment configuration when you select the Use advanced mode installation check box.

   Deployment configuration	Advanced mode installation wizard pages
   New forest	Domain NetBIOS name
   New domain in an existing forest	On the Choose a Deployment Configuration page, the option to create a new domain tree appears only in advanced mode installation. Domain NetBIOS name Source Domain Controller
   Additional domain controller in an existing domain	Install from Media Source Domain Controller Specify Password Replication Policy (for RODC installation only)
   Create an account for a read-only domain controller (RODC) installation	Specify Password Replication Policy
   Attach a server to an account for an RODC installation	Install from Media Source Domain Controller

   
   
4. The Operating System Compatibility page will be displayed, take a moment to read it and click Next
   
   
5. Choose Create a new domain in a new forest, Click Next
   
   
6. Enter the Fully Qualified Domain Name of the forest root domain inside the textbox, click Next
   
   
7. If you selected Use advanced mode installation on the Welcome page, the Domain NetBIOS Name page appears. On this page, type the NetBIOS name of the domain if necessary or accept the default name and then click Next.
   
   
8. Select the Forest Functional Level, choose the level you desire and click on Next. Make sure to read the description of each functional level to understand the difference between each one.
   
   
9. In the previous step, If you have selected any Forest Functional Level other than Windows Server 2008 and clicked on Next , you would then get a page to select the Domain Functional Level. Select it and then click on Next
   
   
   
10. In the Additional Domain Controller Options page, you can select to install the Domain Name Service  to your server. Note that the First domain controller in a forest must be a Global Catalog  that's why the checkbox beside Global Catalog is selected and it cannot be cleared. The checkbox is also selected by default when you install an additional domain controller in an existing domain, however you can clear this checkbox if you do not want the additional domain controller to be a global catalog server. The first domain controller in a new forest or in a new domain can not be a Read Only Domain Controller (RODC), you can later add a RODC but you must have at least one Windows Server 2008 Domain Controller.
    
    I want to set my DC as a DNS Server as well, so I will keep the checkbox beside DNS Server selected and click on Next
    
    
    
11. If the wizard cannot create a delegation for the DNS server, it displays a message to indicate that you can create the delegation manually. To continue, click Yes
    
12. Now you will have the location where the domain controller database, log files and SYSVOL are stored on the server.
    The database stores information about the users, computers and other objects on the network. the log files record activities that are related to AD DS, such information about an object being updated. SYSVOL stores Group Policy objects and scripts. By default, SYSVOL is part of the operating system files in the Windows directory
    
    Either type or browse to the volume and folder where you want to store each, or accept the defaults and click on Next
    
    
    
13. In the Directory Services Restore Mode Administrator Password (DSRM) page, write a password and confirm it. This password is used when the domain controller is started in Directory Services Restore Mode, which might be because Active Directory Domain Services is not running, or for tasks that must be performed offline.
    Make sure that you memorize this password when you need it. I know many administrators forgot it when they most needed it !! 
    
    
    
    Make sure the password meet the password complexity requirements of the password policy, that is a password that contains a combination of uppercase and lowercase letters, numbers, and symbols. else you will receive the following message  :
    
    
    
14. Summary page will be displayed showing you all the setting that you have set . It gives you the option to export the setting you have setup into an answer file for use with other unattended operations, if you wish to have such file, click on the Export settings button and save the file.
    
    
    
15. DNS Installation will start
    
    
16. Followed by installing Group Policy Management Console, the system will check first if it is installed or not.
    
    
    
17. Configuring the local computer to host active  directory Domain Services and other operations will take place setting up this server as a Domain Controller
    
    
    
    
    
    
    
    
    
    
18. Active Directory Domain Services installation will be completed, click Finish, then click on Restart Now to restart your server for the changes to take effect.
    
    
    
    
    
19. Once the server is booted and you logon to it, click on  Start > Administrative Tools ,  will notice that following have been installed :

• Active Directory Domains and Trusts
• Active Directory Sites and Services
• Active Directory Users and Computers
• ADSI Edit
• DNS
• Group Policy Management
  
  

Summary

Setting up a Domain Controller in Windows Server 2008 to install Active Directory Domain Services is performed by running the dcpromo command. It has some new options like using Advanced Mode Installation, and exporting settings to an answer file . In my next articles, I will show you how to perform an unattended installation to set up your domain controller, and also how to set up an additional domain controller using Windows Server 2008.