Migrating DHCP from Windows 2003 to Windows 2012 and setting up failover: Part 1

The principles of DHCP are simple and Microsoft has not changed its core since before Windows NT days, however its not something you shouldn’t undertake lightly or ill-prepared. Most of your client devices will rely on DHCP to function and failing to migrate seamlessly will only cause disruptions to your business.

This article is to help document how to migrate multiple active DHCP servers to a new DHCP server running on Windows Server 2012. We will finalise the configuration by creating a failover for all scopes to a secondary server. I am writing the to include all the necessary information that I think is required to complete this successfully.UPDATE: Added information regarding to “DNS dynamic update registration credentials”

Every scenario will differ slightly however these steps should be useful for most migrations. In my environment I will be migrating my DHCP servers as part of a larger Domain Controller upgrade/migration project and will only document the DHCP aspect.
Current DHCP configuration:

• DC01 – DHCP server with scopes for all systems at headquaters campus
• DC02 – DHCP server with scopes for all systems at warehouse campus

Proposed Configuration:

• DC03 – DHCP server with all scopes
• DC01 (rebuilt) – DHCP failover server

History

I wont cover what already most people reading this blog know but I will advise you all to have a glance here (http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol) and spend a moment refreshing your memory.

Key points are:

• DHCP stands for Dynamic Host Configuration Protocol
• Based off standards in RFC 1531 (http://tools.ietf.org/html/rfc1531)
• Common settings sent to clients are IP Address, default route, DNS servers and DNS Domain
• UDP port 67 for sending data to the server
• UDP port 68 for data to the client
• DHCP operations fall into four basic phases: IP Discovery, IP Lease Offer, IP Request, and IP Lease Acknowledgment (often abbreviated as DORA)

Preparing your network

There are a number on tasks to do before you start migrating DHCP. Below are the prerequisite steps I had to perform.

• Configure IP Helper addressWe have multiple subnets in our environment and our old (and new) DHCP servers will live in one subnet. For clients in other subnets to be able to communicate to the DHCP server (without itself having its own IP address) we configure these IP Helper addresses to direct the requests to specific servers. Note you can have multiple IP Helpers to direct your request to. For my migration most of our subnets have the following IP Helpers:
  • IP Helper 1 – DC01 DHCP
  • IP Helper 2 – DC02 DHCP
  • IP Helper 3 – DC03 DHCP
  • IP Helper 4 – SCCM Server for Client PXE booting

  When a client sends a broadcast, the message will be sent to all DHCP servers and the SCCM server. If the broadcast is for DHCP, all 3 DHCP servers will go to action it, however part of the broadcast includes the subnet that the client belongs to. In turn you will only get a response from the DHCP server hosting that scope. (May differ if you have split scope DHCP configured)

  The IP helper will forward UDP broadcast packets of the following types:

  • Trivial File Transfer Protocol (TFTP)
  • Domain Name Service (DNS)
  • Network Time Service
  • NetBIOS Name Server
  • NetBIOS Datagram Server
  • BootPC and DHCP
  • TACACS requests
• Clean up existing DHCP configuration
  Looking into our existing DHCP I noticed there were a number of scope options and settings that, over time, have been miss-configured and could do with correcting. In my situation I decided to do this before migration as it means I’m not migrating things I don’t need to. My examples of things needing change:
  • STANDARD/OPTION 046 WINS/NBT Node Type was still configured, even though OPTION 044 was removed. This can easily be removed as its not being used.
  • Microsoft/OPTION 001 Microsoft Disable Netbios Option was only configured on one scope for testing and never propagated to all scopes
  • Disabled scope that has not been used for years – removed completely
  • Obsolete/old Reservations that are no longer required
  • Address Pool exclusions that have been configured to cater for systems no longer in place

• Reduce lease time
  Reduce lease time on your DHCP scopes that will be migrated. This reduces risks in the event that there is a problem, because your clients will automatically renew after that point.

Installing DHCP on Windows Server 2012

This process alone has been documented quite heavily online so I will document the PS cmdlets only. Please refer to resources down the bottom for more detailed process with GUI installation.

1. Build Windows Server 2012 with static IP address (eg. 192.168.1.2)
2. Install feature: Add-WindowsFeature  -IncludeManagementTools dhcp
   Note: IncludeManagementTools switch is required if you plan on managing DHCP from the console of the machine
3. Create DHCP security groups: netsh dhcp add securitygroups
4. Restart the service for settings to take effect: Restart-service dhcpserver
5. Authorizing the DHCP server in Active Directory: Add-DhcpServerInDC  <hostname of the DHCP server>  <IP address of the DHCP server>. Eg. Add-DhcpServerInDC DC02 192.168.1.2
   Note: This is only needed for a domain-joined setup.

The above steps have all the details removed as the steps are fairly self explanatory. Personally I use Server Manager to install this feature as its so simple to follow the wizard.

Initial configuration

Now that you have your new DHCP service running and the server is healthy, you can go into DHCP Management Console and start preparing to migrate your DHCP scopes. The first thing I do is manually add the server predefined scope options that are required for all scopes.  To do this, expand your server name, expand IPv4, right click on Server Options and select ‘Configure Options…’.

In my case the two default scopes are:

• 006 DNS Servers  – Two IP’s for our two Active Directory servers that host DNS
• 015 DNS Domain Name – The Active Directory name that DNS hosts

There is also a requirement for us to add an additional scope that is not a default. To do this we need to set predefined options. To do this expand your server name, right click on IPv4 and select ‘Set Predefined Options…’.

Once there, Click on ‘Add…’ and fill in the options. In my situation I needed to add OPTION 252 WPAD however the same steps can be used to add any Predefined Option.

Details I used:

• Name: WPAD
• Data Type: String
• Code: 252
• Description: WPAD discovery point for proxy server

Click Ok to save the predefined option. Follow the same steps as above to add the new option to your Server Options.

My configuration looks like the following screenshot. At this point the server is ready for me to migrate DHCP configuration from Windows 2000, 2003, 2008 and 2012 DHCP servers.

I also configure the DNS dynamic update registration credentials.

A DHCP server can enable dynamic updates in the DNS namespace for any one of its clients that support these updates. Scope clients can use the DNS dynamic update protocol to update their host name-to-address mapping information whenever changes occur to their DHCP-assigned address. (This mapping information is stored in zones on the DNS server.) A DHCP server can perform updates on behalf of its DHCP clients to any DNS server, but it must first supply proper credentials.These credentials are used by DHCP to dynamically update the DNS server and should be configured if the DHCP and DNS server resides on the same operating system.

To do this the user must be part of either ‘Administrators’ or ‘DHCP Administrators’ group. In my environment i created a domain user account, and added membership to ‘DHCP Administrators’ group. I believe in 2003/2008 you could add the user to ‘DnsUpdateProxy’ group, however the Windows 2012 suggest using the ‘DHCP Administrators’ group.

Migrating initial scope for testing

I may be overly cautious however when it comes to potentially causing havoc to the business I like to test things work before affecting everyone. The initial scope I am migrating will be our VDI clients VLAN where we only have 38 currently registered IP addresses.

Note: The following steps need to be made in a short span of time so read through them all before executing, and prepare yourself for it.

1. Logon to the DHCP Server with the test scope that you want to migrate
2. Load the DHCP MMC console, navigate to the scope, right click on it and select Deactivate. This will prevent new leases from being created.

3. Open a command prompt. If you are running Windows Server 2008/2012 be sure to load it with elevated privileges (Right click -> Run As Administrator)
4. Type cd\ and press enter to navigate to the root of the drive (default will be C:\ drive)
5. Type NETSH DHCP SERVER export dhcp-vlan7.db 192.168.7.0 and press enter. This will export all details about that VLAN to a binary file in the root of the drive.
6. Logon to the DHCP Server you want to migrate to.
7. Open a command prompt. If you are running Windows Server 2008/2012 be sure to load it with elevated privileges (Right click -> Run As Administrator)
8. Type PUSHD \\DC1\C$ and press enter. (Where DC1 is the server name that you logged onto in step 1, and C$ is the root drive that you navigated to in step 3). PUSHD/POPD is a great little trick that allows you to temporarily map a network share and assign it a drive letter.
9. Type NETSH DHCP SERVER import dhcp-vlan7.db 192.168.7.0 and press enter. This will import all details about the VLAN into the DHCP database.
10. Load the DHCP MMC console on the new server. You may need to refresh the console for the new scope to become visible. Once visible, navigate to the scope, right click on it and select Activate. This will allow new leases to be created on the new server.

You have now successfully migrated the data for that VLAN and your clients should be able to pick up from where they left off. I do suggest you monitor that machines are renewing their existing addesses (extending their leases) and no clients are having problems. Should there be any issues and you want to revert back, simply run step 10, then step 2. This will bring it back to your original server however if a client has tried to renew their lease, you will have to work on that client individually to rectify the  issue. In my situation I had issues with my Wyse VDI terminals and it took some time to reset their DHCP details. Windows PC’s are much easier by running the following command:

IPCONFIG /RELEASE && IPCONFIG /RENEW

Migration of all Leases

From this point you are confident in migrating the rest of your scopes from all your old DHCP servers. You can do them all in one hit, or stagger them just to be sure there are no other problems. I staged my migration as an extra precaution.  The steps in the previous section explain how to do this for one scope. Below are examples that you can change for step 5 & 9, otherwise the rest can stay the same.

• NETSH DHCP SERVER export dhcp-vlan7.db 192.168.7.0
  This, as documented above exports just one scope to a database file
• NETSH DHCP SERVER export dhcp-vlan7and8.db 192.168.7.0 192.168.8.0
  This exports 2 scopes at the same time. You can apply the same principle to export more than two scopes. The file name ” dhcp-vlan7and8.db” can be called anything – I gave it a sensible name so I knew what to import later.
• NETSH DHCP SERVER export dhcp.db all
  This exports ALL scopes into the database. Note if you do export all the scopes, and you decide to import all scopes on the new DHCP server, you may overwrite existing scope data. This can cause inconsistencies and problems when it comes to issuing leases.

Configuring DHCP Failover

This section will be coming soon in a separate post.

Resources

• IP Helper Addresses for DHCP
  http://allaboutmylife.wordpress.com/2007/10/17/ip-helper-addresses-for-dhcp/
• UDP Helper Address
  http://en.wikipedia.org/wiki/UDP_Helper_Address
• DHCP Step-by-Step Guide: Demonstrate DHCP Split Scope with Delay on a Secondary Server in a Test Lab
  http://technet.microsoft.com/en-us/library/ee405264(v=ws.10).aspx
• Installing and Configuring DHCP role on Windows Server 2012
  http://blogs.technet.com/b/teamdhcp/archive/2012/08/31/installing-and-configuring-dhcp-role-on-windows-server-2012.aspx
• How to use the Netsh utility to export and import DHCP scopes
  http://support.microsoft.com/kb/281626
• DHCP: Credentials for DNS update should be configured if secure dynamic DNS update is enabled and the domain controller is on the same host as the DHCP server
  http://technet.microsoft.com/en-us/library/ee941181%28v=ws.10%29.aspx
• Dynamic DNS Updates with Windows 2008 R2 DHCP Server using Registration Credentials
  http://www.lillbit.com/index.php?option=com_content&view=article&id=87:dynamic-dns-updates-with-windows-2008-r2-dhcp-server-using-registration-credentials&catid=37:microsoft-tips&Itemid=60
• Event ID 1056 Is Logged After Installing DHCP
  http://support.microsoft.com/kb/282001