How to Set Up DHCP on Windows Server

Before you begin: prerequisites

A DHCP server becomes responsible for addressing on your network, so get the basics right first:

• A supported Windows Server installation (Standard or Datacenter). A trial or evaluation build is fine for a lab.
• A static IP address on the server. A DHCP server must never get its own address from DHCP. Set a fixed IPv4 address, subnet mask, gateway and DNS on the network adapter before you install the role — a static IPv4 address is listed as a prerequisite in Microsoft's DHCP Server quickstart.
• A planned address range. Decide which addresses on your subnet DHCP will lease, and which are reserved for servers and network gear. A common home or small-office example is the 192.168.1.0/24 network with a mask of 255.255.255.0.
• Only one DHCP authority per range. If your router already runs DHCP for the same subnet, turn its DHCP off first. Two servers leasing the same range causes address conflicts.
• Rights to authorize (domain only). To authorize a DHCP server in Active Directory you need an account with permission to create the server object in the directory — typically a member of Enterprise Admins or someone with delegated rights over the NetServices container.

Step 1 — Install the DHCP Server role

You can do this with the graphical Server Manager or with one line of PowerShell.

Using Server Manager

1. Open Server Manager and choose Manage → Add Roles and Features.
2. Click through Before You Begin, keep Role-based or feature-based installation, and select your local server.
3. On the Server Roles page, tick DHCP Server. When the pop-up offers to add the required management tools, click Add Features.
4. Click Next through the remaining pages and then Install. No reboot is required for the role itself.

Using PowerShell

Open an elevated PowerShell window and run:

Install-WindowsFeature -Name DHCP -IncludeManagementTools

This installs the role and the DHCP management console and PowerShell module, and — as Microsoft's Install-WindowsFeature reference documents — -IncludeManagementTools is what pulls in those tools alongside the role itself. The post-install configuration in the next step still has to be done separately.

Step 2 — Complete post-install and authorize in Active Directory

Installing the role does not finish the job. There is a short post-install step that creates the local security groups DHCP uses (DHCP Administrators and DHCP Users) and, in a domain, authorizes the server.

Using Server Manager

1. After the install completes, look for the yellow notification flag near the top right of Server Manager. Click it and choose Complete DHCP configuration.
2. The DHCP Post-Install Configuration Wizard opens. On the Authorization page, if this is a domain member, supply credentials that can authorize a DHCP server in Active Directory and choose Use the following user's credentials (or specify alternate credentials). On a workgroup server, choose Skip AD authorization.
3. Click Commit, then Close. The wizard creates the two security groups and authorizes the server where applicable.

Using PowerShell

The equivalent commands create the security groups — Add-DhcpServerSecurityGroup is documented as adding the DHCP Users and DHCP Administrators groups — restart the service so they take effect, and authorize the server in the directory (replace the name and address with your server's):

Add-DhcpServerSecurityGroup
Restart-Service DHCPServer
Add-DhcpServerInDC -DnsName "dhcp01.corp.example.com" -IPAddress 192.168.1.10

You can confirm the server is authorized with Get-DhcpServerInDC, which lists every authorized DHCP server in the domain.

Step 3 — Create a scope

A scope is the heart of a DHCP server: the pool of addresses it can lease, together with the settings clients receive. Open the DHCP console from Server Manager (Tools → DHCP) or run dhcpmgmt.msc.

1. In the console tree, expand your server, right-click IPv4 and choose New Scope. Click Next in the wizard.
2. Type a Name and description that make the scope's purpose clear, such as Office LAN — 192.168.1.0. Click Next.
3. Set the IP Address Range: a Start IP address and End IP address for the pool — for example 192.168.1.100 to 192.168.1.200 — and the Subnet mask (for a /24 network that is 255.255.255.0). Every address in the range must be valid for your network and not otherwise in use. Click Next.
4. On the Add Exclusions and Delay page, enter any addresses inside the range that DHCP should not lease (see Step 4). You can skip this for now and add exclusions later. Click Next.
5. Set the Lease Duration — how long a client keeps an address before it must renew. The default of 8 days suits stable wired networks; shorten it for guest or heavily mobile networks where devices come and go. Click Next.
6. Choose Yes, I want to configure these options now to set the common client options, and click Next.
7. Default gateway (Router): type the gateway address clients should use — usually your router or firewall, for example 192.168.1.1 — click Add, then Next.
8. DNS: type your Parent domain (for example corp.example.com) and the DNS server addresses clients should use. In an Active Directory network these should be your domain controllers, not a router or public resolver. Click Add for each, then Next.
9. If you use a WINS server, add it here; most modern networks do not and can leave this blank. Click Next.
10. Choose Yes, I want to activate this scope now and click Next, then Finish.

The scripted equivalent creates a scope and sets the gateway, DNS servers and DNS domain as scope-level options:

Add-DhcpServerv4Scope -Name "Office LAN" `
  -StartRange 192.168.1.100 -EndRange 192.168.1.200 `
  -SubnetMask 255.255.255.0 -State Active

Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 `
  -Router 192.168.1.1 `
  -DnsServer 192.168.1.10 -DnsDomain corp.example.com

Step 4 — Add exclusions and reservations

Two features keep DHCP from clashing with fixed addresses and let you pin specific devices.

Exclusions — keep DHCP away from static addresses

An exclusion range is a block of addresses inside the scope that DHCP will never lease. Use it to protect addresses you have assigned by hand to servers, printers, access points or the gateway.

1. In the DHCP console, expand the scope and select Address Pool.
2. Right-click Address Pool and choose New Exclusion Range.
3. Enter the Start IP address and End IP address to exclude — for a single address, put the same value in both fields — then click Add and Close.

From PowerShell:

Add-DhcpServerv4ExclusionRange -ScopeId 192.168.1.0 `
  -StartRange 192.168.1.100 -EndRange 192.168.1.110

Reservations — a fixed address, still managed by DHCP

A reservation ties one address in the scope to a device's MAC address, so that device always receives the same address from DHCP. This is the clean way to give a printer or server a consistent address without hand-configuring it on the device. Find the device's MAC address on the device itself, or on Windows with ipconfig /all (listed as the Physical Address).

1. Expand the scope, right-click Reservations and choose New Reservation.
2. Enter a Reservation name, the IP address to assign, and the device's MAC address.
3. Leave Supported types at Both unless you have a reason to change it, click Add, then Close.

From PowerShell (MAC address written without separators or with hyphens):

Add-DhcpServerv4Reservation -ScopeId 192.168.1.0 `
  -IPAddress 192.168.1.150 -ClientId AA-BB-CC-DD-EE-FF `
  -Name "Reception-Printer"

Step 5 — Verify leases

With the scope active, confirm clients are actually getting addresses.

1. On a client on the same network, open a command prompt and run ipconfig /renew to request an address, then ipconfig /all to check the assigned address, subnet mask, gateway, DNS servers and the DHCP Server that issued the lease.
2. Back on the server, in the DHCP console expand the scope and open Address Leases. Each active client appears with its IP address, name, lease expiry and MAC address.
3. Prefer PowerShell? List every lease in a scope with:

   Get-DhcpServerv4Lease -ScopeId 192.168.1.0

To see how full a scope is, Get-DhcpServerv4ScopeStatistics -ScopeId 192.168.1.0 reports the number of addresses in use and the percentage of the pool consumed — useful for spotting a scope that is running out of room before clients start failing to get addresses.

Where to go next

Once a single scope is serving reliably, the natural next steps are to add scopes for other subnets, configure DHCP failover between two servers so addressing survives one server going offline, and review your lease duration and reservations as the network grows. If you have not yet built out the directory those DNS options point at, start with our companion guide on setting up Active Directory on Windows Server.

Frequently asked

Do I have to authorize the DHCP server in Active Directory?

If the server is a member of an Active Directory domain, yes. An unauthorized DHCP server in a domain will refuse to hand out leases, because Active Directory keeps a list of authorized servers to block rogue ones. You authorize it from the post-install wizard or from the DHCP console, using an account that can create the DHCP server object in the directory. A DHCP server in a workgroup, with no Active Directory to check against, does not need this and starts serving as soon as it has an active scope.

Should a DHCP server use a static IP address?

Yes. A DHCP server must have a fixed, manually configured IPv4 address before you install the role. It cannot hand out addresses reliably if its own address might change, and clients and other services need to reach it at a known address. Set the static address, subnet mask, gateway and DNS on the server's network adapter first, then install the DHCP Server role.

What is the difference between an exclusion and a reservation?

An exclusion range is a set of addresses inside the scope that DHCP will never lease to anyone, which you use to protect addresses assigned statically to servers, printers or the gateway. A reservation ties one specific address in the scope to one device's MAC address, so that device always gets the same address from DHCP while still being managed centrally. Use exclusions for devices configured by hand and reservations for devices you want DHCP to pin to a consistent address.

How do I check that clients are getting addresses?

In the DHCP console, expand the scope and open Address Leases to see every client that currently holds a lease, with its address, name and lease expiry. From PowerShell, run Get-DhcpServerv4Lease with the scope ID to list the same information. On a client you can run ipconfig /all to confirm it received an address from the correct DHCP server, or ipconfig /renew to force it to request one.