JSI Tip 3113. How do I minimize the potential for name hijacking on my network?

If you have any older DHCP clients on your Windows 2000 DHCP server network, the DHCP server can perform Dynamic DNS registration on behalf of the client computer. These older clients include:

Microsoft Windows 95Microsoft Windows 98 or Windows 98 Second EditionMicrosoft Windows NT version 3.51 or 4.0UNIXMacintosh

These older clients can use the DHCP server to perform Dynamic DNS registration, overwriting the DNS records of a legitinmate computer, thus hijacking its' name.

To minimize the possibility of name hijacking on your network:

- If possible, do NOT install DNS and DHCP server services on the same computer.

- Install Windows 2000 SP1 to take advantage of the ability to have the DHCP server impersonate an account to perform DNS registration.

NOTE: The DHCP service service runs under the DCs computer account and had Full Control of all DNS objects.

To make use of this security feature, you must have:

- Active Directory-integrated zones.

- A user account that you set up in Active Directory to perform the impersonation.

To implement DHCP server name impersonation for Dynamic DNS registration, use the Netsh.exe tool:

netsh dhcp server set dnscredentials password

NOTE: If you enter a password of *, you will be prompted to type the password.

NOTE: If the command completes successfully. you will receive Command Successfully Completed.

NOTE: You must stop and restart the DHCP Server service for Netsh.exe changes to become effective.

To subsequently remove this impersonation:

netsh dhcp server delete dnscredentials dhcpfullforce

To show the account that the DHCP Server service uses for DNS registrations:

netsh dhcp server show dnscredentials

If you configure impersonation and it fails when starting the DHCP Server service, Dynamic DNS registration will NOT be performed and the System event log will contain:

Event Type: ErrorEvent Source: DHCP server nameEvent Category: NoneEvent ID: 1002Date: 5/31/2000Time: 3:21:47 PMUser: N/AComputer: computer nameDescription: The DHCP service failed to initialize its global parameters.The following error occurred: Logon failure: unknown user name or bad password.Data: 0000: 2e 05 00 00