11.1 DHCP Server Role, the DORA Lifecycle & Active Directory Authorization
Key Takeaways
- DHCP leases are negotiated by the four-step DORA exchange (Discover, Offer, Request, Acknowledge) over UDP port 67 to the server and UDP port 68 back to the client.
- A client attempts renewal unicast at 50% of the lease (T1) and rebinding broadcast at 87.5% (T2), which is why a short lease multiplies server load.
- A domain-joined Windows Server DHCP server must be authorized in Active Directory with Add-DhcpServerInDC or it shuts the service down and logs Event ID 1046.
- Authorization is the built-in rogue-DHCP defence for Windows servers, but it cannot stop a non-Windows rogue server, which requires DHCP snooping on the switch fabric.
- Because DHCP Discover is a broadcast, clients on a different subnet need a relay agent or an IP helper address on the router to reach a centralized DHCP server.
DHCP Server Role, the DORA Lifecycle & Active Directory Authorization
Dynamic Host Configuration Protocol (DHCP) on Windows Server automates the assignment of IPv4 and IPv6 network parameters—including IP addresses, default gateways, subnet masks, Domain Name System (DNS) servers, and vendor-specific options—to network clients. This section covers the two foundations of that infrastructure: the four-step DORA lease lifecycle with its renewal timers, and the Active Directory authorization rules that stop rogue servers from answering. Scopes, the option inheritance hierarchy, reservations, and cross-subnet relay routing are covered in section 11.2; high availability in section 11.3; and diagnosing addressing failures across on-premises and Azure in section 11.5.
1. DHCP Architecture & The DORA Process
The fundamental IPv4 address acquisition protocol consists of four sequential broadcast/unicast message exchanges termed DORA (Discover, Offer, Request, Acknowledge). Windows Server DHCP services operate over UDP port 67 (DHCP Server) and UDP port 68 (DHCP Client).
+-----------------------------------------------------------------------------+
| THE DHCP DORA LEASE LIFECYCLE |
| |
| [DHCP CLIENT (0.0.0.0:68)] [DHCP SERVER (10.10.1.10:67)]|
| | | |
| | -------- 1. DHCPDISCOVER (Broadcast) --------> | |
| | Src: 0.0.0.0:68 Dst: 255.255.255.255:67 | (Allocates |
| | Payload: Client MAC (00-15-5D-01-02-03) | IP lease) |
| | | |
| | <------- 2. DHCPOFFER (Unicast/Broadcast) ---- | |
| | Src: 10.10.1.10:67 Dst: 10.10.1.100:68 | |
| | Offered IP: 10.10.1.100, Subnet: /24 | |
| | | |
| | -------- 3. DHCPREQUEST (Broadcast) ---------> | |
| | Src: 0.0.0.0:68 Dst: 255.255.255.255:67 | (Confirms |
| | Server ID: 10.10.1.10, Requested: .100 | selection) |
| | | |
| | <------- 4. DHCPACK (Unicast/Broadcast) ------ | |
| | Src: 10.10.1.10:67 Dst: 10.10.1.100:68 | (Commits to |
| | Includes Options: Router, DNS, Domain Name | database) |
| v v |
+-----------------------------------------------------------------------------+
The Four Phases of DORA:
- DHCPDISCOVER (Client to Network): The client initializes its network stack without an IP address (
0.0.0.0) and broadcasts aDHCPDISCOVERframe to255.255.255.255across UDP port 67. The payload embeds the client's hardware (MAC) address and requested parameters (Option 55 - Parameter Request List). - DHCPOFFER (Server to Client): Every DHCP server receiving the broadcast checks its active scopes. If an available IP exists, the server temporarily reserves that IP and transmits a
DHCPOFFERmessage containing the offered IP, subnet mask, lease duration, and the server's own IP identifier. - DHCPREQUEST (Client to Network): The client selects one offer (typically the first received) and broadcasts a
DHCPREQUESTmessage. Broadcasting this message is critical: it notifies the chosen DHCP server that its offer was accepted, while simultaneously signaling all other responding DHCP servers to release their reserved provisional offers back into their available pools. - DHCPACK (Server to Client): The selected server validates the request, commits the lease binding to its local Jet database (
dhcp.mdb), and sends aDHCPACKframe containing the definitive IP configuration and all associated DHCP options (such as default gateway, DNS servers, and domain suffixes). If the address is no longer available, the server returns aDHCPNAK, forcing the client to restart the Discover process.
Lease Renewal Timers (T1 and T2):
- T1 Timer (Renewal - 50% of Lease Duration): At exactly 50% elapsed lease time (e.g., Day 4 of an 8-day lease), the client sends a unicast
DHCPREQUESTdirectly to the original leasing server. If the server is online, it responds with a unicastDHCPACK, resetting the lease timer. - T2 Timer (Rebinding - 87.5% of Lease Duration): If the original server fails to respond by 87.5% of the lease (e.g., Day 7 of an 8-day lease), the client enters the Rebinding state and broadcasts a
DHCPREQUESTto any reachable DHCP server on the network. - Lease Expiration (100% of Lease Duration): If no DHCPACK is received when the lease expires, the client immediately drops the IP address, flushes its network stack, assigns itself an Automatic Private IP Addressing (APIPA) address (
169.254.0.0/16), and restarts theDHCPDISCOVERcycle.
2. Active Directory Authorization & Rogue DHCP Prevention
To prevent rogue or misconfigured DHCP servers from issuing invalid IP parameters—which can cause denial-of-service or man-in-the-middle attacks—Windows Server enforces Active Directory authorization for domain-joined DHCP servers.
+-----------------------------------------------------------------------------+
| ACTIVE DIRECTORY DHCP AUTHORIZATION WORKFLOW |
| |
| [DHCP Server Service Starts] |
| | |
| v |
| [Queries AD DS Configuration Partition: CN=NetServices] |
| | |
| +--------+--------+ |
| | | |
| (Listed in AD DS?) (NOT Listed in AD DS?) |
| | | |
| v v |
| [AUTHORIZED] [UNAUTHORIZED: ROGUE STATE] |
| - Services - DHCP Server Service Shuts Down Automatically |
| client leases - Logs Event ID 1046 in System Event Log |
| - Event ID 1044 - Refuses to service client DHCPDISCOVER packets |
+-----------------------------------------------------------------------------+
Authorization Rules and Mechanics:
- Directory Storage: Authorized DHCP servers are registered in the Active Directory Configuration partition under:
CN=NetServices,CN=Services,CN=Configuration,DC=contoso,DC=com - Administrative Privilege: Authorizing a DHCP server requires membership in the Enterprise Admins group (or delegated write permissions to the
NetServicescontainer). - Operating States:
- Domain-Joined DHCP Server: On service startup, the server broadcasts a
DHCPINFORMquery and checks the AD DSNetServicescontainer. If its IP/FQDN is listed, it initializes (Event ID 1044). If not listed, it logs Event ID 1046 and halts the DHCP Server service immediately. - Standalone (Non-Domain) DHCP Server: If a standalone DHCP server boots onto a subnet where a domain exists and detects an authorized domain DHCP server, the standalone server shuts down automatically. If no domain is detected, it operates independently in a workgroup.
- Domain-Joined DHCP Server: On service startup, the server broadcasts a
# Authorize a domain-joined DHCP Server in Active Directory
Add-DhcpServerInDC -DnsName 'dhcp01.corp.contoso.com' -IPAddress 10.10.1.10
# Query all authorized DHCP servers across the AD DS Forest
Get-DhcpServerInDC
# Remove authorization for a decommissioned server
Remove-DhcpServerInDC -DnsName 'dhcp-old.corp.contoso.com'
An administrator deploys a centralized Windows Server DHCP server to manage multiple remote branch subnets. Clients in remote subnets are failing to receive IP addresses. Which mechanism must be enabled on the remote branch router to ensure the centralized DHCP server selects the correct address scope?
A newly deployed Windows Server 2025 domain member server has the DHCP Server role installed and configured with an active scope. However, when the DHCP Server service starts, it immediately shuts down and logs Event ID 1046 in the System event log. What is the root cause of this failure?