Skip to content
WinBookUnofficial

DNS and DHCP on Windows Server 2025: a lab that does not break the LAN

Verified 1 min read

Install DNS and DHCP roles on a Windows Server 2025 lab DC, set forwarders, scopes and options, authorize DHCP, and test without creating a rogue server.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Lab (E1)
Evidence
E1Official documentation
Verified
2026-10-28
Page type
Server role

The short answer

Section titled “The short answer”

DNS and DHCP are easy to install and easy to break a LAN with. In a lab:

  • DNS is usually installed with AD DS; add forwarders for external names.
  • DHCP must be authorized in AD before it serves clients.
  • Never run a second DHCP server on a network that already has one unless you control the scope and the switch.

If you only need name resolution for the lab, DNS alone is enough. Add DHCP when you need clients to get addresses automatically.

DNS

Section titled “DNS”

On the DC:

Terminal window
Get-DnsServerForwarder
Add-DnsServerForwarder -IPAddress 1.1.1.1,9.9.9.9
Resolve-DnsName microsoft.com
  • The DC’s own DNS should point to itself; forwarders handle external names.
  • Do not put a public DNS server on the DC’s adapter; it can create a split-brain resolution path.
  • Keep recursion on for a lab; a public-facing DNS server needs a different design.
  • Test both internal (dc1.lab.internal) and external names.

DHCP

Section titled “DHCP”
Terminal window
Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerv4Scope -Name 'Lab' -StartRange 10.10.10.100 -EndRange 10.10.10.199 -SubnetMask 255.255.255.0
Set-DhcpServerv4OptionValue -ScopeId 10.10.10.0 -Router 10.10.10.1 -DnsServer 10.10.10.10 -DnsDomain lab.internal
Add-DhcpServerInDC -DnsName dc1.lab.internal -IPAddress 10.10.10.10

Then:

  • set option 003 (router), 006 (DNS), 015 (domain);
  • exclude the DC/router addresses;
  • add reservations for servers/printers;
  • test with a client ipconfig /renew;
  • check Get-DhcpServerv4Lease.

Verify

Section titled “Verify”
Terminal window
Get-DhcpServerv4Scope
Get-DhcpServerv4OptionValue
Get-DhcpServerInDC
Get-DnsServerZone
Resolve-DnsName dc1.lab.internal

From a client:

Terminal window
ipconfig /all
ipconfig /renew
nltest /dsgetdc:lab.internal

If the client gets an address but cannot resolve the domain, check option 006 and the DC’s DNS service before rebuilding anything.

Lab boundaries

Section titled “Lab boundaries”
  • One DNS/DHCP server is a lab, not redundancy.
  • DHCP failover is a separate design; do not pretend a single scope is highly available.
  • Keep the scope inside the isolated lab network; do not leak it to the home LAN.
  • Snapshot before changing scope/options; document the rollback.

Sources