yes and no, some of them are but we were not sure if removing the machine from the domain would help. the open question we had for this approach was if the machine is removed from the domain, couldn't the machine still get on the network and get an IP address from the DHCP server using there local credentials file? If we remove the workstation from the domain, will it not be able to get an IP address?
PS - i understand the issue you mentioned with the static IP address, however I'm dealing with end users. So, I'm sure some of them might be able to figure that out, however most probably don't know how and its not that big of a security issue for us, if they did because they are our employees. what we are really trying to do is get the people that are using these machines to call our help desk so we can upgrade them
Main Topics
Browse All Topics
by: mrwortaPosted on 2009-07-24 at 18:07:45ID: 24940287
If you're using a linux dhcpd it is simple.
You could create a reservation for each host which assigns a bogus address to the "rogue" hosts.
In the .conf it would look like this:
host <hostname> { hardware ethernet <MAC address>; fixed-address 172.16.99.99; }
On Windows you could use netsh to create reservations on the dhcp server.
For example:
netsh dhcp server scope <the scope> add reservedip 172.16.99.99 <MAC address> Bogus Bogus BOTH
But both solutions are not very elegant. And not very secure - Unless you're going to implement security on switch level a user could assign a static ip to his workstation.
Are these PC's still members of your domain?