How to Install and Configure DHCP on Windows Server

Windows Server DHCP setup is straightforward when the network plan is settled first: give the server a static IP, install and authorize the DHCP role, create a scope, configure gateway and DNS options, then test from a client. Most failures come from wrong bindings, missing relay configuration, or overlapping static addresses-not from the installation command.

Plan the network before installing DHCP on Windows Server

I have seen DHCP installations fail for reasons that had nothing to do with the installation itself. The role was present, the service was running, and clients still received the wrong gateway because another device was answering first. Before you install anything, assign the server a static IP, choose the address pool, and check that no unauthorized DHCP server is active on the same VLAN.

DHCP uses UDP port 68 on the client and UDP port 67 on the server for IPv4. Clients on different VLANs need a DHCP relay configured on the router or Layer 3 switch so their requests can reach the server. The DORA sequence-Discover, Offer, Request, Acknowledge-is the basic address-allocation process described in RFC 2131.

Information to prepare first

• The DHCP server’s static IPv4 address
• The network block and subnet mask to distribute
• Static device addresses that must stay outside the dynamic pool
• The default gateway
• The IP addresses of internal DNS servers
• The domain name and intended lease duration

For example, on 192.168.10.0/24, you might use 192.168.10.1 as the gateway, allocate 192.168.10.50 through 192.168.10.200, and define an internal DNS server at 192.168.10.2. Do not leave the DHCP server itself dependent on DHCP for its address.

What to do – Write down the network block, gateway, DNS addresses, static assignments, and pool boundaries before you begin.

Installing the DHCP Server role

You can install DHCP through Server Manager or PowerShell. I use PowerShell when I expect to repeat the setup, but Server Manager is perfectly reasonable for a one-off deployment. This command installs the role and its management tools:

Install-WindowsFeature DHCP -IncludeManagementTools

A Success : True result confirms that the role installation completed. The DHCP service is installed at this point, but the server still needs authorization in Active Directory and a configured scope.

Check both the role and service:

Get-WindowsFeature -Name DHCP
Get-Service -Name DHCPServer

On a domain-joined server, DHCP authorization requires suitable Active Directory credentials. After checking the server’s FQDN and static IP address, you can authorize it from the DHCP console by right-clicking the server name and selecting Authorize. The PowerShell equivalent is:

Add-DhcpServerInDC -DnsName "dhcp01.example.local" -IpAddress 192.168.10.10
Get-DhcpServerInDC

Authorization applies to Active Directory-integrated DHCP deployments. A workgroup server does not use this authorization process, but it still needs a correct scope, network path, and protection against other DHCP servers.

The Server Manager wizard installs the same role through a graphical interface. After installation, complete the DHCP configuration task shown in the notification area so the required security group and authorization settings are not forgotten.

What to do – Verify the role, service, FQDN, static address, and authorization state before creating the first scope.

Creating a new DHCP scope

A scope defines the addresses that may be leased on one network, along with the options distributed with those addresses. Do not confuse the network address with the broadcast address. In 192.168.10.0/24, the network address is 192.168.10.0 and the broadcast address is 192.168.10.255; neither belongs to a client.

Creating an IPv4 scope with PowerShell

Add-DhcpServerv4Scope -Name "Office LAN" -StartRange 192.168.10.50 -EndRange 192.168.10.200 -SubnetMask 255.255.255.0 -State Active

This creates a pool of 151 addresses. The range from 192.168.10.1 through 192.168.10.49 remains outside the pool and can be used for servers, printers, and network devices. Addresses above 192.168.10.200 are outside the pool too, so they do not need to be added as exclusions.

If a reserved address falls inside the scope, exclude it explicitly:

Add-DhcpServerv4ExclusionRange -ScopeId 192.168.10.0 -StartRange 192.168.10.60 -EndRange 192.168.10.60

In this example, 192.168.10.60 stays available for a static device. The range must be inside the scope for an exclusion to be useful. I prefer keeping most infrastructure addresses outside the scope, because that makes the design easier to read and reduces the number of rules someone has to remember six months later.

Check separately that statically configured devices do not overlap the DHCP pool. Giving the same IP address to two devices can create unstable ARP behavior and intermittent connectivity; the basics are covered in What Is ARP? Address Resolution Protocol Explained.

What to do – Keep static assignments outside the dynamic pool where possible, and use exclusions for reserved addresses that must remain inside it.

Which values belong in the scope options?

An IP address alone is not enough. Without a gateway, a client cannot reach other networks; without DNS, it cannot resolve hostnames. In the Windows DHCP console, these values are configured under Scope Options. In PowerShell, use the option command for gateway, DNS, and domain suffix values.

Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 -Router 192.168.10.1 -DnsServer 192.168.10.2,192.168.10.3 -DnsDomain "example.local"

DHCP option 003 represents the router, option 006 represents DNS servers, and option 015 represents the DNS domain suffix, as documented in RFC 2132. Use DNS server addresses that clients can actually reach. If you use public DNS, decide separately how internal names will be resolved.

When name resolution fails, first inspect what the client received:

ipconfig /all
ipconfig /release
ipconfig /renew
nslookup example.local

Read the DHCP Enabled, IPv4 Address, Default Gateway, and DNS Servers lines together in the ipconfig /all output. Looking only at the IP address gives you an incomplete diagnosis. What Is DNS_PROBE_FINISHED_NXDOMAIN and How to Fix It also explains the basic DNS side of this investigation.

Choosing the lease duration

The lease duration determines how long an address remains assigned to a client. Permanently connected desktops may work well with a longer period such as eight days. A guest network, busy wireless network, or network with short-lived devices may be better served by four hours or one day. A lease that is unnecessarily short creates extra DHCP traffic; one that is too long delays the return of unused addresses to the pool.

Set-DhcpServerv4Scope -ScopeId 192.168.10.0 -LeaseDuration 8.00:00:00

The value uses the days.hours:minutes:seconds format. Changing it does not immediately remove existing leases; clients receive the new duration during a renewal.

When should you use a DHCP reservation?

A reservation assigns the same IP address to a particular client identifier each time. It is useful for printers, cameras, IP phones, and management interfaces that should use DHCP but must remain reachable at a predictable address. Unlike a manually configured static IP, the device remains centrally managed through DHCP.

Add-DhcpServerv4Reservation -ScopeId 192.168.10.0 -IPAddress 192.168.10.60 -ClientId "00-11-22-33-44-55" -Name "Office Printer" -Description "Accounting printer"

Depending on the Windows Server version and client type, ClientId may appear in a format different from the familiar MAC address. Inspect current leases before adding a reservation:

Get-DhcpServerv4Lease -ComputerName dhcp01 -ScopeId 192.168.10.0 | Format-Table IPAddress,ClientId,HostName,AddressState

Do not create multiple reservations for the same client identifier. In virtualized environments, inspect the network identities of cloned machines too. Copied MAC addresses can lead to surprising assignments.

Configuring DHCP failover

If a single DHCP server fails, new clients cannot obtain addresses and existing clients may have trouble renewing their leases. Windows Server DHCP failover lets two DHCP servers share scope information. The two supported operating modes are:

For a failover partnership, both servers need synchronized clocks, network connectivity, and the same scope. DHCP failover communication uses TCP port 647, so firewall rules must allow that connection between the partners.

Add-DhcpServerv4Failover -ComputerName dhcp01 -PartnerServer dhcp02 -Name "DHCP-Failover" -ScopeId 192.168.10.0 -SharedSecret "Strong-Shared-Secret" -Mode LoadBalance -LoadBalancePercent 50

Do not leave the shared secret in command history in production. Review PowerShell history and centralized logging policies, and use a safer credential-handling method where appropriate.

Check the partnership after creating it:

Get-DhcpServerv4Failover -ComputerName dhcp01
Get-DhcpServerv4FailoverStatistics -ComputerName dhcp01

The relationship should show normal communication, with the partner reachable and scope synchronization confirmed. Failover is not a backup, so export the DHCP configuration separately.

What to do – During a controlled maintenance window, disable the first server and confirm that a new client can still obtain an address from the partner.

DHCP security and unauthorized server checks

DHCP is one of the first configuration sources on a network, so a rogue server can cause serious damage. It could give clients an attacker’s gateway or DNS server. If your switch supports DHCP snooping, mark only the port connected to the legitimate DHCP server as trusted.

On Windows Server, check these items regularly:

• Confirm that the DHCP server is authorized in Active Directory when the deployment uses a domain.
• Monitor scope utilization and address conflicts.
• Keep DHCP audit logs enabled.
• Limit administrative access to the people who need it.
• Do not expose the DHCP server to unnecessary internet access.

DHCP audit logs are normally stored under C:\Windows\System32\dhcp. Their names follow the DhcpSrvLog-*.log pattern. Review service status, scope information, and lease records together. Restarting the service without reading the logs does not remove the cause of a problem.

Testing and troubleshooting after installation

For the first test, use a Windows client on the same VLAN. Clear its current configuration and request a new lease:

ipconfig /release
ipconfig /renew
ipconfig /all
ping 192.168.10.1
nslookup example.com

If the client receives an address in the 169.254.0.0/16 range, it may not have received a DHCP response. Check the VLAN, switch port, cable, Windows Firewall, DHCP service, and relay configuration in that order. A client on another VLAN will not reach the server if DHCP relay is missing, because the server will never see its Discover packet.

View active scopes and leases on the server:

Get-DhcpServerv4Scope
Get-DhcpServerv4Lease -ScopeId 192.168.10.0
Get-DhcpServerv4Binding

In the Get-DhcpServerv4Binding output, confirm that DHCP is bound to the intended network adapter. A server with multiple NICs can be bound to the wrong interface. If packet-level inspection is necessary, use Wireshark to follow DHCP Discover and Offer packets. If the client’s request is visible but no Offer returns, investigate the server, binding, scope, and firewall.

You can export the configuration with the Windows Server DHCP export command:

Export-DhcpServer -ComputerName dhcp01 -File "C:\Backup\dhcp-config.xml" -Leases -Force

Before restoring, verify both the XML file and the target server’s network settings. Creating the backup file is not enough; test the import on an isolated test server. I once put a printer’s manually assigned address inside a DHCP pool and spent too long looking at the printer before checking the scope boundaries. Since then, I write static assignments beside the pool range, not in a separate document that nobody opens.

What to do – Check ipconfig /all, gateway reachability, DNS resolution, bindings, and logs as one test sequence instead of treating the IP address as the whole diagnosis.

Check These Before Going Live

• Assign the DHCP server a static IP address.
• Document the subnet, gateway, DNS servers, static assignments, and pool boundaries.
• Install the DHCP role and verify the DHCPServer service.
• Authorize the server in Active Directory when the deployment requires it.
• Create the scope without overlapping network, broadcast, or static addresses.
• Configure gateway, DNS, domain suffix, reservations, and lease duration.
• Test a client lease, gateway connection, DNS lookup, logs, failover, and backup restore.

Frequently Asked Questions

Sources

• Microsoft Learn – DHCP Overview — learn.microsoft.com
• RFC 2131 – Dynamic Host Configuration Protocol — rfc-editor.org
• RFC 2132 – DHCP Options and BOOTP Vendor Extensions — rfc-editor.org