Windows – How to “segregate” non-domain DHCP clients with Windows 2012 R2

dhcp-servernpswindows

I search a way to prevent network access to devices not belonging to our corporate Active Directory domain.

Some people connect their personnal laptops to our corporate network, and some of them unintentionnally cause problems.

I aleady use a DHCP policy to give them a separate DNS name (aliens.contoso.com), allowing me to quickly see if such a device is connected (I just have a look at the DNS console). This policy is activated when the client does not belong to our contoso.com domain.
The problem with this method is: the unwanted laptop has perfectly corrects IP settings, so the user can use it.
This only allow to have a separate DNS name. I can't specify a different router or an unusable IP address.

We'd like to assign unusable IP settings to those laptops. So the users won't use it, or phone us. This will allow us to ensure the laptop is clean, and to give directions to the users.

Of course they can manually enter the correct settings, but few of our users can do that, and this will considerably reduce the problems.
I don't plan to enforce network access with 802.1X. I know the DHCP method is weaker.

I think we can do it with Network Protection Server (we use Windows 2012 R2 for our server), but I didn't understood how.

Best Answer

In short: you can't

In order for the DHCP server to know if a device is inside the domain, it have to communicate with a domain controler, thus it first have an IP address.
This is why the settings you want are greyed out.

A trick can be to name your computer with a special prefix. Then the DHCP server can detect it when the computer negociate it DHCP lease. So the desired option will be available (not greyed out).

Related Topic