Lesson 5 — DNS & DHCP

# Install DNS Server role (often installed with AD DS automatically)
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Open DNS Manager GUI
dnsmgmt.msc

# Verify DNS Server service is running
Get-Service DNS | Select-Object Name, Status, StartType

Zone Types

# Create a Forward Lookup Zone
Add-DnsServerPrimaryZone -Name "lab.local" -ReplicationScope "Forest" -DynamicUpdate "Secure"
# ReplicationScope: Forest, Domain, Legacy, None (None=file-based)
# DynamicUpdate: Secure (AD-integrated only), Nonsecure, None

# Create a Reverse Lookup Zone for 192.168.1.0/24
Add-DnsServerPrimaryZone -NetworkID "192.168.1.0/24" -ReplicationScope "Forest"

# List all zones
Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated, IsReverseLookupZone

# Create DNS records via PowerShell
# A record
Add-DnsServerResourceRecordA -Name "web01" -ZoneName "lab.local" -IPv4Address "192.168.1.50"

# CNAME record
Add-DnsServerResourceRecordCName -Name "www" -ZoneName "lab.local" -HostNameAlias "web01.lab.local."

# MX record (priority 10)
Add-DnsServerResourceRecordMX -Name "@" -ZoneName "lab.local" `
  -MailExchange "mail.lab.local" -Preference 10

# PTR record (reverse lookup)
Add-DnsServerResourceRecordPtr -Name "50" -ZoneName "1.168.192.in-addr.arpa" `
  -PtrDomainName "web01.lab.local."

# TXT record (SPF example)
Add-DnsServerResourceRecord -Txt -Name "@" -ZoneName "lab.local" `
  -DescriptiveText "v=spf1 ip4:192.168.1.0/24 mx ~all"

# List all records in a zone
Get-DnsServerResourceRecord -ZoneName "lab.local" |
  Select-Object HostName, RecordType, RecordData | Sort-Object RecordType, HostName

# Delete a record
Remove-DnsServerResourceRecord -ZoneName "lab.local" -Name "oldserver" -RRType "A" -Force

Forwarders

When the DNS server cannot resolve a name from its own zones, it forwards the query to another DNS server (the forwarder). If the forwarder cannot answer, the server falls back to Root Hints.

# Add forwarders (queries for unknown domains go to Google or ISP DNS)
Add-DnsServerForwarder -IPAddress "8.8.8.8","8.8.4.4"
Add-DnsServerForwarder -IPAddress "1.1.1.1"  # Cloudflare

# View current forwarders
Get-DnsServerForwarder

# Remove a forwarder
Remove-DnsServerForwarder -IPAddress "8.8.4.4"

Conditional Forwarders

Conditional forwarders send queries for a specific domain to a designated DNS server. Used for inter-company resolution or split-brain DNS scenarios.

# Forward all queries for "subsidiary.com" to their DNS server
Add-DnsServerConditionalForwarderZone `
  -Name "subsidiary.com" `
  -MasterServers "10.10.10.10" `
  -ReplicationScope "Forest"

# Example: forward queries for Azure private DNS zone to Azure DNS
Add-DnsServerConditionalForwarderZone `
  -Name "privatelink.blob.core.windows.net" `
  -MasterServers "168.63.129.16"   # Azure DNS IP

Get-DnsServerZone | Where-Object {$_.ZoneType -eq "Forwarder"}

# Basic name resolution test
nslookup dc01.lab.local
nslookup dc01.lab.local 192.168.1.10     # Query a specific DNS server

# PowerShell DNS resolution (more detailed)
Resolve-DnsName dc01.lab.local
Resolve-DnsName lab.local -Type MX      # Query specific record type
Resolve-DnsName lab.local -Type SRV     # Check AD SRV records
Resolve-DnsName lab.local -Server 192.168.1.10  # Use specific DNS server

# Flush DNS cache (client-side — clears local resolver cache)
ipconfig /flushdns

# View current DNS cache (client)
ipconfig /displaydns | Select-String "Record Name"

# Clear DNS Server cache (on the DNS server itself)
Clear-DnsServerCache -Force

# View DNS server statistics
Get-DnsServerStatistics | Select-Object -ExpandProperty RecordStatistics

# AD DNS health check
dcdiag /test:DNS /v

# Check AD SRV records exist (critical for domain functionality)
nslookup -type=SRV _ldap._tcp.lab.local
nslookup -type=SRV _kerberos._tcp.lab.local
nslookup -type=SRV _gc._tcp.lab.local

# Install DHCP role
Install-WindowsFeature -Name DHCP -IncludeManagementTools

# Open DHCP Manager GUI
dhcpmgmt.msc

# CRITICAL: Authorize DHCP server in Active Directory
# (Unauthorized DHCP servers are blocked from leasing IPs in AD domains)
Add-DhcpServerInDC -DnsName "SRV-DC01.lab.local" -IPAddress 192.168.1.10

# Verify DHCP server is authorized
Get-DhcpServerInDC

# Notify Server Manager that DHCP post-install config is done
Set-ItemProperty -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 `
  -Name ConfigurationState -Value 2

A scope defines the pool of IP addresses the DHCP server can assign, along with the associated options (gateway, DNS, etc.).

# Create a DHCP scope for the 192.168.1.0/24 network
Add-DhcpServerv4Scope `
  -Name "LAN Scope" `
  -StartRange 192.168.1.100 `
  -EndRange 192.168.1.200 `
  -SubnetMask 255.255.255.0 `
  -LeaseDuration (New-TimeSpan -Days 8) `
  -Description "Main LAN DHCP Scope" `
  -State Active

# Add exclusion range (exclude IPs used by servers/printers/switches)
Add-DhcpServerv4ExclusionRange `
  -ScopeId 192.168.1.0 `
  -StartRange 192.168.1.100 `
  -EndRange 192.168.1.110

# Set scope-level DHCP options
# Option 003: Default Gateway (Router)
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 -Router 192.168.1.1

# Option 006: DNS Servers
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 -DnsServer 192.168.1.10,192.168.1.11

# Option 015: DNS Domain Name
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 -DnsDomain "lab.local"

# Option 066/067: PXE Boot (for deploying Windows via WDS)
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 -OptionId 66 -Value "192.168.1.20"  # WDS server
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 -OptionId 67 -Value "boot\x64\wdsnbp.com"

# View scope configuration
Get-DhcpServerv4Scope | Format-List *
Get-DhcpServerv4OptionValue -ScopeId 192.168.1.0

Common DHCP Option Numbers

A reservation permanently assigns a specific IP to a device based on its MAC address. The device always receives the same IP but still goes through the DHCP process.

# Create a DHCP reservation (bind IP to MAC address)
Add-DhcpServerv4Reservation `
  -ScopeId 192.168.1.0 `
  -IPAddress 192.168.1.50 `
  -ClientId "00-1A-2B-3C-4D-5E" `
  -Name "Printer-HR-01" `
  -Description "HP LaserJet in HR office"

# List all reservations in a scope
Get-DhcpServerv4Reservation -ScopeId 192.168.1.0 |
  Select-Object IPAddress, ClientId, Name, Description

# Find a client's MAC address (run on the client or look in DHCP leases)
# On the client:
Get-NetAdapter | Select-Object Name, MacAddress

# Find existing lease by hostname (then create reservation from it)
$lease = Get-DhcpServerv4Lease -ScopeId 192.168.1.0 | Where-Object {$_.HostName -like "PRINTER*"}
Add-DhcpServerv4Reservation -ScopeId 192.168.1.0 -IPAddress $lease.IPAddress -ClientId $lease.ClientId -Name $lease.HostName

DHCP Failover (introduced in Server 2012) allows two DHCP servers to share a scope for redundancy. No manual scope synchronization needed.

# Configure DHCP Failover between SRV-DC01 (primary) and SRV-DC02 (partner)
# Run on the PRIMARY DHCP server:

# Hot Standby mode (SRV-DC02 holds 5% of scope for emergencies)
Add-DhcpServerv4Failover `
  -Name "LAN-Failover" `
  -PartnerServer "SRV-DC02.lab.local" `
  -ScopeId 192.168.1.0 `
  -Mode HotStandby `
  -ServerRole Active `
  -StandbyPercentage 5 `
  -SharedSecret "SuperSecret123!" `
  -AutoStateTransition $true `
  -StateSwitchInterval (New-TimeSpan -Minutes 60)

# Load Balance mode (50/50 split)
Add-DhcpServerv4Failover `
  -Name "LAN-LoadBalance" `
  -PartnerServer "SRV-DC02.lab.local" `
  -ScopeId 192.168.1.0 `
  -Mode LoadBalance `
  -LoadBalancePercent 50 `
  -SharedSecret "SuperSecret123!"

# View failover configuration
Get-DhcpServerv4Failover

# Replicate scope changes to partner (when you add reservations, options, etc.)
Invoke-DhcpServerv4FailoverReplication -Name "LAN-Failover" -Force

# --- Client-side troubleshooting ---

# Release current DHCP lease and request a new one
ipconfig /release
ipconfig /renew
ipconfig /all        # Verify IP, mask, gateway, DNS, DHCP server, lease info

# PowerShell — view current IP config
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer

# Test connectivity to DHCP server (UDP port 67)
Test-NetConnection -ComputerName 192.168.1.10 -Port 67

# --- Server-side troubleshooting ---

# View all active DHCP leases
Get-DhcpServerv4Lease -ScopeId 192.168.1.0 |
  Select-Object IPAddress, HostName, ClientId, LeaseExpiryTime, AddressState |
  Sort-Object IPAddress

# Find a specific lease by hostname or IP
Get-DhcpServerv4Lease -ScopeId 192.168.1.0 | Where-Object {$_.HostName -like "LAPTOP*"}

# Check scope address utilization
Get-DhcpServerv4ScopeStatistics -ScopeId 192.168.1.0 |
  Select-Object ScopeId, AddressesFree, AddressesInUse, PercentageInUse, Reserved

# View DHCP server audit log (records all lease activity)
# Log path: C:\Windows\System32\dhcp\DhcpSrvLog-Mon.log (Mon, Tue, Wed...)
Get-Content "C:\Windows\System32\dhcp\DhcpSrvLog-$(((Get-Date).DayOfWeek).ToString().Substring(0,3)).log" |
  Select-Object -Last 50

# Check DHCP database integrity
netsh dhcp server check database