Windows Server DHCP and DNS: Enterprise Configuration

Introduction

Windows Server DHCP and DNS are foundational services in enterprise environments. While these services seem simple on the surface, enterprise deployments require careful planning: DHCP failover clustering, DNS scavenging, split-brain DNS for internal vs external resolution, and integration with Active Directory. This guide teaches you to configure and troubleshoot Windows DHCP and DNS for production environments.

Installing DHCP and DNS Roles

POWERSHELL

# Install both roles
Install-WindowsFeature -Name DHCP, DNS -IncludeManagementTools

# For DHCP: authorize server in Active Directory
Add-DhcpServerInDC -DnsName "dhcp01.company.local" -IPAddress 192.168.1.10

# Verify authorization
Get-DhcpServerInDC

DHCP Scope Configuration

POWERSHELL

# Create DHCP scope for a subnet
Add-DhcpServerv4Scope `
  -Name "Main Office" `
  -StartRange 192.168.1.100 `
  -EndRange 192.168.1.200 `
  -SubnetMask 255.255.255.0 `
  -State Active `
  -LeaseDuration (New-TimeSpan -Days 8)

# Add scope options (default gateway, DNS servers)
Set-DhcpServerv4OptionValue `
  -ScopeId 192.168.1.0 `
  -Router 192.168.1.1 `
  -DnsServer 192.168.1.10, 192.168.1.11 `
  -DnsDomain "company.local"

# Exclusion range (for static IPs)
Add-DhcpServerv4ExclusionRange `
  -ScopeId 192.168.1.0 `
  -StartRange 192.168.1.100 `
  -EndRange 192.168.1.110

# Reservation for printer (always same IP)
Add-DhcpServerv4Reservation `
  -ScopeId 192.168.1.0 `
  -IPAddress 192.168.1.150 `
  -ClientId "AA-BB-CC-DD-EE-FF" `
  -Name "Reception-Printer" `
  -Description "Konica Minolta reception printer"

DHCP Failover (High Availability)

POWERSHELL

# Configure DHCP failover between two servers
# Run on primary server:
Add-DhcpServerv4Failover `
  -Name "MainOffice-Failover" `
  -PartnerServer "dhcp02.company.local" `
  -ScopeId 192.168.1.0 `
  -Mode HotStandby `           # or LoadBalance
  -ServerRole Active `         # This server is active
  -StandbyScopePercent 5 `     # 5% held by standby
  -AutoStateTransition $true ` # Auto switch if primary fails
  -MaxClientLeadTime (New-TimeSpan -Hours 2)

# Verify failover
Get-DhcpServerv4Failover

DNS Zone Configuration

POWERSHELL

# Active Directory-integrated zone (best practice)
Add-DnsServerPrimaryZone `
  -Name "company.local" `
  -ReplicationScope "Forest" `  # Replicate to all DCs in forest
  -DynamicUpdate Secure         # Only AD-authenticated updates

# Add forward lookup records
Add-DnsServerResourceRecordA `
  -ZoneName "company.local" `
  -Name "webserver" `
  -IPv4Address "192.168.1.50"

# Add PTR record (reverse lookup)
Add-DnsServerResourceRecordPTR `
  -ZoneName "1.168.192.in-addr.arpa" `
  -Name "50" `                   # Last octet
  -PtrDomainName "webserver.company.local."

# Add CNAME (alias)
Add-DnsServerResourceRecordCName `
  -ZoneName "company.local" `
  -Name "intranet" `
  -HostNameAlias "webserver.company.local"

# Add MX record for email
Add-DnsServerResourceRecordMX `
  -ZoneName "company.local" `
  -Name "@" `
  -MailExchange "mail.company.local" `
  -Preference 10

Split-Brain DNS (Internal vs External)

Split-brain means different DNS answers for internal and external clients:

POWERSHELL

# Internal DNS: company.com resolves to internal IP
Add-DnsServerPrimaryZone -Name "company.com" -ReplicationScope Forest -DynamicUpdate Secure
Add-DnsServerResourceRecordA -ZoneName "company.com" -Name "app" -IPv4Address "10.0.0.50"
# Clients inside network get 10.0.0.50

# External DNS (public): company.com → 203.0.113.50
# Configured on public DNS servers (not Windows Server)
# External clients get 203.0.113.50 → hits NAT → reaches 10.0.0.50

DNS Scavenging (Remove Stale Records)

POWERSHELL

# Enable scavenging on server
Set-DnsServerScavenging `
  -ScavengingState $true `
  -RefreshInterval (New-TimeSpan -Days 7) `
  -NoRefreshInterval (New-TimeSpan -Days 7) `
  -ScavengingInterval (New-TimeSpan -Days 7)

# Enable scavenging on specific zone
Set-DnsServerZoneAging `
  -Name "company.local" `
  -Aging $true `
  -RefreshInterval (New-TimeSpan -Days 7) `
  -NoRefreshInterval (New-TimeSpan -Days 7)

# Manually trigger scavenging now
Start-DnsServerScavenging

# View scavenging timestamps on records
Get-DnsServerResourceRecord -ZoneName "company.local" -Name "oldpc" |
  Select-Object -ExpandProperty RecordData

Troubleshooting DHCP Issues

POWERSHELL

# Check DHCP server statistics
Get-DhcpServerv4Statistics

# View active leases
Get-DhcpServerv4Lease -ScopeId 192.168.1.0 |
  Where-Object {$_.AddressState -eq "Active"} |
  Select-Object IPAddress, ClientId, HostName, LeaseExpiryTime

# Find a device by MAC address
Get-DhcpServerv4Lease -ScopeId 192.168.1.0 |
  Where-Object {$_.ClientId -eq "AA-BB-CC-DD-EE-FF"}

# Check DHCP conflicts (IPs in use but not leased)
Get-DhcpServerv4Conflict -ScopeId 192.168.1.0

# View DHCP audit log
Get-Content "C:WindowsSystem32dhcpDhcpSrvLog-Mon.log" | Select-String "AA-BB-CC"

Troubleshooting DNS Issues

POWERSHELL

# Test DNS resolution
Resolve-DnsName "webserver.company.local" -Server 192.168.1.10

# View DNS debug log
Set-DnsServerDiagnostics -All $true
# Log at: C:WindowsSystem32dnsdns.log

# Check DNS replication between DCs
repadmin /showrepl

# Force DNS zone transfer from primary to secondary
Start-DnsServerZoneTransfer -ZoneName "company.local" -FullTransfer

# Flush DNS cache on server
Clear-DnsServerCache

# Flush DNS cache on client
ipconfig /flushdns

# Test reverse lookup
Resolve-DnsName "192.168.1.50" -Server 192.168.1.10

# Check DNSSEC validation
Resolve-DnsName "company.local" -DnssecOk -Server 192.168.1.10

Monitoring DHCP and DNS

POWERSHELL

# DHCP scope utilization report
Get-DhcpServerv4ScopeStatistics -ScopeId 192.168.1.0

# Alert when scope is 80% full
$stats = Get-DhcpServerv4ScopeStatistics -ScopeId 192.168.1.0
$utilization = $stats.PercentageInUse
if ($utilization -gt 80) {
    Send-MailMessage -To "ops@company.com" -Subject "DHCP Scope 80% full" `
      -Body "Scope 192.168.1.0 is $utilization% full" `
      -SmtpServer "mail.company.local"
}

Windows DHCP and DNS are mature, reliable services when properly configured. The key best practices: always use AD-integrated zones, configure DHCP failover before you need it, enable scavenging to prevent stale records, and use reservations for devices that need predictable IPs.