Windows DHCP server: scopes, reservations and failover

Start DC01, SRV01 and CL01. Sign in to SRV01 as SAATLAB\Administrator and open PowerShell as administrator.

1Install the DHCP role on SRV01

On SRV01, run this:

Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerSecurityGroup
Restart-Service DHCPServer

You should see something like this:

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {DHCP Server, Remote Server Administration Tools, ...}

Add-DhcpServerSecurityGroup creates the local groups DHCP Administrators and DHCP Users, which Server Manager’s post-install wizard would otherwise do for you.

✅ Checkpoint: The DHCP Server role installed with Success and the DHCPServer service restarted.

2Authorise SRV01 in Active Directory

On SRV01, run this:

Add-DhcpServerInDC -DnsName SRV01.saatlab.internal -IPAddress 10.0.0.20
Get-DhcpServerInDC
Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\ServerManager\Roles\12 -Name ConfigurationState -Value 2

You should see something like this:

IPAddress DnsName
--------- -------
10.0.0.20 srv01.saatlab.internal

The last line tells Server Manager the setup is finished, so its yellow “complete DHCP configuration” flag disappears. Authorisation is stored in AD’s configuration partition, so it’s forest-wide.

✅ Checkpoint: Get-DhcpServerInDC lists SRV01 with 10.0.0.20.

3Create the LabNet scope and its options

On SRV01, run this:

Add-DhcpServerv4Scope -Name 'LabNet clients' -StartRange 10.0.0.100 -EndRange 10.0.0.200 -SubnetMask 255.255.255.0 -LeaseDuration 8.00:00:00 -State Active
Add-DhcpServerv4ExclusionRange -ScopeId 10.0.0.0 -StartRange 10.0.0.190 -EndRange 10.0.0.200
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -Router 10.0.0.1 -DnsServer 10.0.0.10, 10.0.0.11 -DnsDomain saatlab.internal
Get-DhcpServerv4Scope | Select-Object ScopeId, Name, StartRange, EndRange, LeaseDuration, State
Get-DhcpServerv4OptionValue -ScopeId 10.0.0.0 | Select-Object OptionId, Name, Value

You should see something like this:

ScopeId  Name           StartRange EndRange   LeaseDuration State
-------  ----           ---------- --------   ------------- -----
10.0.0.0 LabNet clients 10.0.0.100 10.0.0.200 8.00:00:00    Active

OptionId Name            Value
-------- ----            -----
      51 Lease           {691200}
      15 DNS Domain Name {saatlab.internal}
       6 DNS Servers     {10.0.0.10, 10.0.0.11}
       3 Router          {10.0.0.1}

Option 51 is the lease time in seconds (8 days). The exclusion keeps 10.0.0.190 to 10.0.0.200 unused by DHCP, for devices you’ll configure by hand later, such as a printer in Lesson 18.

✅ Checkpoint: The scope is Active, and options 3, 6 and 15 show the gateway, both DCs and saatlab.internal.

4Move CL01 from its fixed address to DHCP

On CL01, in PowerShell as administrator (sign in as SAATLAB\Administrator):

Remove-NetIPAddress -InterfaceAlias Ethernet -AddressFamily IPv4 -Confirm:$false
Remove-NetRoute -InterfaceAlias Ethernet -DestinationPrefix 0.0.0.0/0 -Confirm:$false
Set-NetIPInterface -InterfaceAlias Ethernet -Dhcp Enabled
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ResetServerAddresses
ipconfig /renew
(Get-NetIPAddress -InterfaceAlias Ethernet -AddressFamily IPv4).IPAddress
(Get-NetRoute -InterfaceAlias Ethernet -DestinationPrefix 0.0.0.0/0).NextHop
(Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4).ServerAddresses

You should see something like this:

10.0.0.100
10.0.0.1
10.0.0.10
10.0.0.11

On SRV01, look at the lease from the server side:

Get-DhcpServerv4Lease -ScopeId 10.0.0.0 | Select-Object IPAddress, ClientId, HostName, AddressState

You should see something like this:

IPAddress  ClientId          HostName              AddressState
---------  --------          --------              ------------
10.0.0.100 08-00-27-3a-5c-91 CL01.saatlab.internal Active

The ClientId is CL01’s MAC address; every VirtualBox adapter starts with 08-00-27. Write yours down for the next step.

✅ Checkpoint: CL01 has an address from 10.0.0.100 to 10.0.0.189, gateway 10.0.0.1 and both DCs as DNS servers.

5Give CL01 a reservation

On SRV01, run this with your own MAC address:

Add-DhcpServerv4Reservation -ScopeId 10.0.0.0 -IPAddress 10.0.0.150 -ClientId 08-00-27-3a-5c-91 -Name CL01 -Description 'Lab client'

On CL01, release and renew:

ipconfig /release
ipconfig /renew
(Get-NetIPAddress -InterfaceAlias Ethernet -AddressFamily IPv4).IPAddress

You should see this:

10.0.0.150

A reservation keeps DHCP’s central control while giving a device a predictable address. It’s the right choice for printers and some appliances; servers and DCs still get fixed addresses.

✅ Checkpoint: CL01 now has 10.0.0.150 from its reservation.

6Add DC02 as a failover partner

Shut down CL01 and start DC02. You’ll install DHCP on DC02 remotely, authorise it and share the scope.

In production you’d often use another member server. If DHCP runs on a DC, set DNS update credentials with Set-DhcpServerDnsCredential so its DNS updates don’t run as the DC itself.

On SRV01, run this. Choose your own shared secret:

Install-WindowsFeature DHCP -ComputerName DC02
Invoke-Command -ComputerName DC02 -ScriptBlock { Add-DhcpServerSecurityGroup; Restart-Service DHCPServer }
Add-DhcpServerInDC -DnsName DC02.saatlab.internal -IPAddress 10.0.0.11
Add-DhcpServerv4Failover -Name 'SRV01-DC02' -PartnerServer DC02.saatlab.internal -ScopeId 10.0.0.0 -LoadBalancePercent 50 -SharedSecret 'Lab-Failover-2026!'
Get-DhcpServerv4Failover | Select-Object Name, PartnerServer, Mode, LoadBalancePercent, State

You should see something like this:

Name       PartnerServer         Mode        LoadBalancePercent State
----       -------------         ----        ------------------ -----
SRV01-DC02 DC02.saatlab.internal LoadBalance                 50 Normal

The scope, its options and the reservation now exist on DC02 as well, and both servers know every lease. If SRV01 goes down, DC02 keeps renewing and handing out addresses.

✅ Checkpoint: Failover shows Mode LoadBalance and State Normal, and Get-DhcpServerv4Scope -ComputerName DC02 shows the LabNet scope.

Finish with snapshots. Shut down the VMs, then on your laptop:

'DC01','DC02','SRV01','CL01' | ForEach-Object { VBoxManage snapshot $_ take "DHCP ready" }