DHCP is one of those services nobody thinks about until it stops — and then suddenly every device on the network is complaining it can’t get an address. Setting it up properly on Windows Server isn’t hard, but there are a few steps people skip that cause grief later: authorizing the server in Active Directory, getting the scope options right, and making the service resilient so one server reboot doesn’t take down addressing for the whole site.
This guide goes end to end. Install the role, authorize it in AD, build a scope, set the options that actually matter, carve out reservations and exclusions, and finally configure failover between two servers. Commands are in PowerShell because it’s faster and repeatable, but the same steps exist in the DHCP console if you prefer to click.
Step 1: Install the DHCP role
Add the DHCP Server role with PowerShell. The -IncludeManagementTools flag installs the console and
cmdlets at the same time:
Install-WindowsFeature DHCP -IncludeManagementToolsAfter the role installs, Windows wants a quick post-install step that creates the two local security groups DHCP uses (DHCP Administrators and DHCP Users):
# Create the DHCP security groups and finish post-install
netsh dhcp add securitygroups
Restart-Service dhcpserverGive the server a static IP address before going further. A DHCP server that gets its own address from DHCP is a problem waiting to happen.
Step 2: Authorize the server in Active Directory
This is the step that trips people up. On a domain network, a Windows DHCP server won’t hand out a single address until it’s authorized in Active Directory. Authorization is a deliberate guard against rogue DHCP servers — someone plugging in a home router, or a test server nobody meant to leave running.
Authorize it with one cmdlet (you need Enterprise Admin rights to do this):
# Authorize this DHCP server in AD
Add-DhcpServerInDC -DnsName "dhcp01.corp.local" -IPAddress 10.0.0.20
# Confirm it's now authorized
Get-DhcpServerInDCStep 3: Create a scope
A scope is the range of addresses DHCP can lease for a particular subnet, plus the settings that go with them. Create one for your network:
# Create a scope for the 10.0.0.0/24 network
Add-DhcpServerv4Scope `
-Name "LAN-10.0.0.0" `
-StartRange 10.0.0.100 `
-EndRange 10.0.0.200 `
-SubnetMask 255.255.255.0 `
-State ActiveThat defines a pool of 101 addresses (.100 to .200). Notice the pool deliberately starts at .100 — the lower addresses are left free for servers, gateways, and gear with static IPs. Planning that gap up front saves you from collisions later.
Typical subnet address plan
| 10.0.0.1 – 10.0.0.10 | Network gear: gateway, switches, firewall (static) |
|---|---|
| 10.0.0.11 – 10.0.0.99 | Servers and printers (static or reservations) |
| 10.0.0.100 – 10.0.0.200 | DHCP dynamic pool for clients |
| 10.0.0.201 – 10.0.0.254 | Spare / future static use |
Step 4: Set the scope options
A scope without options just hands out an address with no gateway and no DNS, which gets a client exactly nowhere. The two options that always matter are the default gateway (003) and DNS servers (006). In a domain you usually set the DNS domain name (015) too.
$scope = "10.0.0.0"
# 003 - Default gateway / router
Set-DhcpServerv4OptionValue -ScopeId $scope -Router 10.0.0.1
# 006 - DNS servers (point at your domain controllers)
Set-DhcpServerv4OptionValue -ScopeId $scope -DnsServer 10.0.0.11, 10.0.0.12
# 015 - DNS domain name
Set-DhcpServerv4OptionValue -ScopeId $scope -DnsDomain "corp.local"Step 5: Add exclusions and reservations
Two ways to keep specific addresses under control inside a scope — and they do different jobs.
An exclusion carves addresses out of the pool so DHCP never leases them. Use it when something with a static IP lives inside the scope range:
# Don't lease .150–.160 — reserved for a static appliance range
Add-DhcpServerv4ExclusionRange -ScopeId 10.0.0.0 -StartRange 10.0.0.150 -EndRange 10.0.0.160A reservation pins a specific address to a device’s MAC address, so that device always gets the same IP through DHCP — handy for printers, cameras, or servers you want managed centrally but predictable:
# Always give this printer 10.0.0.105
Add-DhcpServerv4Reservation `
-ScopeId 10.0.0.0 `
-IPAddress 10.0.0.105 `
-ClientId "AA-BB-CC-DD-EE-FF" `
-Description "HP printer - 2nd floor"Exclusion vs reservation
| Exclusion | Address is never leased. For devices configured statically inside the scope range. |
|---|---|
| Reservation | Address is always leased to one MAC. For devices you want managed but with a fixed IP. |
Step 6: Configure DHCP failover
A single DHCP server is a single point of failure. If it reboots for patching, clients with expiring leases can’t renew. DHCP failover (introduced in Server 2012) lets two servers share a scope so addressing survives one going down. It replaced the old split-scope trick.
Set it up from the primary server, pointing at the partner:
# Hot standby: dhcp01 is primary, dhcp02 takes over on failure
Add-DhcpServerv4Failover `
-ComputerName "dhcp01.corp.local" `
-PartnerServer "dhcp02.corp.local" `
-Name "LAN-Failover" `
-ScopeId 10.0.0.0 `
-ServerRole Active `
-ReservePercent 5 `
-SharedSecret "UseAStrongSecretHere"There are two modes to choose between:
DHCP failover modes
| Hot standby | One server actively serves; the partner steps in only on failure. Good for a main + branch or primary + backup. |
|---|---|
| Load balance | Both servers serve clients at the same time, splitting the load (default 50/50). Good for two servers in one site. |
Failover relationships need the partner to already have the DHCP role installed and be authorized in AD. Once configured, the scope and its leases stay in sync between the two servers automatically.
Setup checklist
DHCP server setup checklist
- DHCP role installed with management tools
- Server has a static IP (never DHCP-assigned)
- Post-install security groups created and service restarted
- Server authorized in Active Directory (Get-DhcpServerInDC confirms)
- Scope created with a pool that avoids static address ranges
- Options 003 (gateway) and 006 (DNS = your DCs) set correctly
- Exclusions for any static devices inside the scope range
- Reservations created for printers and managed devices
- Failover configured with a partner server
- Configuration exported for backup/migration
Wrapping up
A working DHCP server comes down to a handful of steps done in the right order: install the role, give the box a static IP, authorize it in AD, build a scope that leaves room for static devices, and set the gateway and DNS options correctly. Get DNS pointed at your domain controllers and most “I have an IP but nothing works” problems never happen.
Once the basics are solid, add a failover partner so a single reboot doesn’t knock the network offline, and keep a config export on hand. If clients still aren’t pulling addresses after all this, the troubleshooting path is in fix DHCP not giving out IP addresses.
