Default DHCP Security Groups on domain?

Question

_{Tuesday, October 24, 2017 10:10 AM}

Hello,

I've seen "DHCP Users" and "DHCP Administrators" security groups exist on Active Directory. I know groups with these same names are created locally to server during DHCP role installation/post-configuration.

Could someone explain when these groups are created to Active Directory? I couldn't find any documentation cover this. Can I use these groups to delegate DHCP management permissions to all DHCP servers in enterprise?

All replies (5)

_{Tuesday, October 24, 2017 10:21 AM}

AFAIK, those groups are created with the first DHCP that has been authorized in the domain.

You could double check by query the "WhenCreated" attribute of those groups...

dsquery * -filter (sAMAccountName="DHCP Administrators") -attr WhenCreated

The creation date should fit with the creation date of the record in the configuration Partition

"CN=DhcpRoot,CN=NetServices,CN=Services,CN=Configuration,DC=MyDomain,DC=Com"

¸hth

This posting is provided AS IS without warranty of any kind

_{Tuesday, October 24, 2017 11:06 AM}

Hi cthivierge,

I think I managed to resolve this.

Those two groups didn't existed on my test domain which has two AD-authorized WS2012R2 DHCP servers.

Instead, those were created to domain after I installed & configured DHCP Server role to one of my Domain Controllers (WS2012R2). Checking timestamp on whenCreated attribute verified this. Thanks for pointing that out.

I suppose these two domain local security groups can be used to delegate DHCP administration to Domain Controllers running DHCP Server role, because DCs do not have local groups. And I suppose you could use these domain groups to delegate DHCP management permissions to member servers running DHCP server role too. Though this is not happening by default.

_{Tuesday, October 24, 2017 11:12 AM}

Correct.  Those groups are for delegating permissions to the DHCP servers

This posting is provided AS IS without warranty of any kind

_{Thursday, October 26, 2017 8:50 AM}

Hi,
Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

Best Regards,

Frank

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Tuesday, October 31, 2017 8:50 AM}

Hi,

Was your issue resolved? 

If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.
If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.
If no, please reply and tell us the current situation in order to provide further help.

Best Regards,
Frank

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].