Re: DHCP security breach


Roger,

I agree with you that theoretically I can preserve integrity of
important DNS records by preventing DHCP from rewriting them. But in
practice, what can I do?

Microsoft recommends to run DHCP under a low privilege account.
I am wondering why Microsoft omits in their docs any recommendations on
ACL that this account must have on DNS zones.

Suppose, I have one zone with 4000 workstations and 300 servers. The
DHCP server acts under a specific AD account. I do not want to tweak
ACLs on every single record in my DNS zone.

What permissions should I give to the DHCP account on my DNS zone?

May be something like this?

Domain Computers = Create child objects
CREATOR/OWNER = Full Control

.

Relevant Pages

  • Re: dynamic DNS not working.
    ... and before I wasn't using an account but have since created an account, ... user full control on the DNS servers with no change. ... the DHCP and removed from the client, ... option available in the DHCP server? ...
    (microsoft.public.windows.server.dns)
  • Re: DHCP security breach
    ... So you are saying that your servers are using DHCP and also ... Have your servers handle their own DNS registrations. ... Microsoft recommends to run DHCP under a low privilege account. ...
    (microsoft.public.win2000.security)
  • Re: DNSAPI Error and corrupt DNS records
    ... But...will it fix the fact that the computer account is not "right" on the ... DNS server list: ... Sent update to server: 10.153.3.50 ... Are these machines DHCP based or static? ...
    (microsoft.public.windows.server.networking)
  • Re: Registry / DHCP database
    ... No real need to backup DNS because unlike DHCP a DNS record can be stored live in multiple places with Secondary Zone's and DNS Zone transfers. ... your name is Pinto. ...
    (microsoft.public.cert.exam.mcsa)
  • Re: Pros/Cons of computer account deletions
    ... If you are using AD DNS and DHCP, you should delte any computer in your ... If you rename the computer, ... delete it's AD account from the OU. ...
    (microsoft.public.win2000.active_directory)