DHCP Best Practices and DC
i've read should not run dhcp on dc. reason this: security? performance? other? i've got couple hundred pcs on net , believe dcs could handle performance standpoint. help.
curt
curt
1." always dynamically update dns , ptr records" - mean asking dhcp register dns records on behalf of client machines. run dhcp on dc, dhcp not register records in dns unless set credentials (standard user credentials). can create 1 user , use credentials dns registration, don't need use admin accounts.
2. instead of above option can use option "dynamically update , ptr records if requested dhcp client machines". if select option, client register records , dhcp register ptr records. need set credentials registering ptr records.
we need use 1 of above 2 options.
3. dynamically update dns , ptr records dhcp clienst not request updates (for example, clients running windows nt 4.0) - option can selected if have network printers/downlevel clients (95/98/nt) or third party os doesn't have functionality of ddns. if uncheck them, mentioned clients unable register dns.
it's difficult crack dc directly when prompt server dc, enables lot of security. dhcp server interact clients directly , reason chance hacker try expolit melicious discover packet duplicate ip request, details network ip range, etc. can use dhcp server service act proxy for run remote execution of melicious codes.
if using encrypted traffic on network, unknown users unable track traffic going through wire.
hope helps.
2. instead of above option can use option "dynamically update , ptr records if requested dhcp client machines". if select option, client register records , dhcp register ptr records. need set credentials registering ptr records.
we need use 1 of above 2 options.
3. dynamically update dns , ptr records dhcp clienst not request updates (for example, clients running windows nt 4.0) - option can selected if have network printers/downlevel clients (95/98/nt) or third party os doesn't have functionality of ddns. if uncheck them, mentioned clients unable register dns.
it's difficult crack dc directly when prompt server dc, enables lot of security. dhcp server interact clients directly , reason chance hacker try expolit melicious discover packet duplicate ip request, details network ip range, etc. can use dhcp server service act proxy for run remote execution of melicious codes.
if using encrypted traffic on network, unknown users unable track traffic going through wire.
hope helps.
Windows Server > Network Infrastructure Servers
Comments
Post a Comment