The Risk of a Single DHCP Server
In a Windows domain network, the DHCP (Dynamic Host Configuration Protocol) server is critical infrastructure. It is responsible for handing out IP addresses, subnet masks, and DNS server configurations to every laptop, smartphone, and printer on the network. If your single DHCP server crashes, the network will slowly collapse. As devices reach their lease expiration times (typically 8 days, or much shorter for Wi-Fi), they will request a renewal, receive no answer, and drop off the network entirely.
Historically, administrators solved this by splitting DHCP scopes (e.g., the 80/20 rule). In modern Windows Server environments, the correct architectural solution is DHCP Failover. This feature links two Windows Servers together. They continuously synchronize their IP lease databases. If the primary server dies, the secondary server instantly takes over, ensuring zero downtime.
While this can be configured via the DHCP MMC snap-in, PowerShell allows you to deploy failover partnerships instantly across multiple subnets.
Step 1: Preparing the Infrastructure
Before you run the PowerShell command, you must have two Windows Servers with the DHCP role installed. The primary server (DHCP-01) should have the active scope (e.g., 192.168.10.0) fully configured. The secondary server (DHCP-02) should have the DHCP role installed, but no scopes configured yet.
Step 2: Configuring Load Balance Failover
There are two modes for DHCP Failover: Load Balance (both servers actively hand out IPs simultaneously) and Hot Standby (the secondary server does nothing unless the primary dies).
Load Balance is the recommended architecture for modern networks.
Open an elevated PowerShell window on the primary server (DHCP-01) and execute the Add-DhcpServerv4Failover cmdlet.
Add-DhcpServerv4Failover -ComputerName "DHCP-01.corp.com" -Name "Corp-Failover-Cluster" -PartnerServer "DHCP-02.corp.com" -ScopeId 192.168.10.0 -LoadBalancePercent 50 -MaxClientLeadTime 01:00:00 -AutoStateTransition $true -StateSwitchInterval 00:30:00 -SharedSecret "SuperSecurePassword123!"Breaking Down the Parameters:
- -Name: The logical name of the partnership.
- -ScopeId: The specific subnet you are failing over. You can list multiple scopes separated by commas.
- -LoadBalancePercent 50: Both servers will split the available IP addresses 50/50 and serve clients actively.
- -MaxClientLeadTime: (MCLT) The amount of time (1 hour in this case) a lease can be extended by the surviving server if the partner dies.
- -AutoStateTransition $true: If the primary server goes offline, the secondary server will automatically declare it dead after the
StateSwitchInterval(30 minutes) and take full ownership of the entire IP pool. - -SharedSecret: A cryptographic password ensuring that rogue servers cannot intercept the DHCP replication traffic.
Step 3: Forcing a Synchronization
The command executes instantly. The primary server reaches out to DHCP-02, creates an identical scope, and begins replicating the active IP leases.
If you make a change to the scope options later (e.g., you change the DNS server IP from 8.8.8.8 to 1.1.1.1), the change does not automatically replicate to the partner immediately.
You must force a synchronization using PowerShell:
Invoke-DhcpServerv4FailoverReplication -ComputerName "DHCP-01.corp.com" -Name "Corp-Failover-Cluster"This ensures both servers are perfectly aligned and ready to handle a catastrophic hardware failure without dropping a single network client.