Fix a Windows DHCP Server That Is Not Authorized in Active Directory

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

The DHCP service starts but does not lease addresses in a domain environment, or the console says the server is not authorized.

Incorrect server FQDN/IP, missing AD authorization, broken DC discovery, DNS or LDAP connectivity, or stale authorization entry.

Diagnostic commands

hostname
ipconfig /all
Get-Service DHCPServer
Get-DhcpServerInDC
nltest /dsgetdc:corp.example.com /force
Resolve-DnsName dc01.corp.example.com
Test-NetConnection dc01.corp.example.com -Port 389

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

The authorized list should contain the exact approved DHCP server FQDN and current IP. The server must resolve and contact AD DS; a failed LDAP/DC discovery test means fix domain connectivity first.

Practical correction

Only after confirming the server is approved, run Add-DhcpServerInDC -DnsName dhcp01.corp.example.com -IPAddress 10.20.0.20. Then check service, client-facing binding, active scopes and DHCP event logs. Do not authorize unknown/rogue DHCP equipment.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Record the existing authorized list before any change. If an incorrect entry was added, remove only that exact entry with Remove-DhcpServerInDC after verifying no live DHCP role uses it. Renew a test client and confirm the intended server issued the lease.

Verification checklist

Success: server remains authorized after AD validation and test clients receive leases from the intended DHCP server. Investigate rogue servers separately at the switch layer.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Should every DHCP server be authorized? Domain-joined Windows DHCP servers must be authorized. Never authorize an unidentified device.

Official technical reference

Microsoft Learn — 56f8870b a7c1 4db1 8a86 f69079fe5077

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.