If you have any older
DHCP clients on your Windows 2000
DHCP server network, the
DHCP server can perform
Dynamic
DNS registration on behalf of the client computer. These older clients include:
Microsoft Windows 95 Microsoft Windows 98 or Windows 98 Second Edition Microsoft Windows NT version 3.51 or 4.0 UNIX MacintoshThese older clients can use the DHCP server to perform Dynamic DNS registration, overwriting the DNS records of a legitinmate computer, thus hijacking its' name.
To minimize the possibility of name hijacking on your network:
- If possible, do NOT install DNS and DHCP server services on the same computer.
- Install Windows 2000 SP1 to take advantage of the ability to have the DHCP server impersonate an account to perform DNS registration.
NOTE: The DHCP service service runs under the DCs computer account and had Full Control of all DNS objects.
To make use of this security feature, you must have:
- Active Directory-integrated zones.
- A user account that you set up in Active Directory to perform the impersonation.
To implement DHCP server name impersonation for Dynamic DNS registration, use the Netsh.exe tool:
netsh dhcp server set dnscredentials <user name> <domain name> password
NOTE: If you enter a password of *, you will be prompted to type the password.
NOTE: If the command completes successfully. you will receive Command Successfully Completed.
NOTE: You must stop and restart the DHCP Server service for Netsh.exe changes to become effective.
To subsequently remove this impersonation:
netsh dhcp server delete dnscredentials dhcpfullforce
To show the account that the DHCP Server service uses for DNS registrations:
netsh dhcp server show dnscredentials
If you configure impersonation and it fails when starting the DHCP Server service, Dynamic DNS registration will NOT be performed and the System event log will contain:
Event Type: Error Event Source: DHCP server name Event Category: None Event ID: 1002 Date: 5/31/2000 Time: 3:21:47 PM User: N/A Computer: computer name Description: The DHCP service failed to initialize its global parameters. The following error occurred: Logon failure: unknown user name or bad password. Data: 0000: 2e 05 00 00