How to Configure Windows Server IPAM (IP Address Management) via PowerShell

The IP Management Chaos

In a small network, managing IP addresses is easy: you open your single DHCP server and look at the active leases. However, in a massive enterprise with 50 different remote offices, you might have 50 different DHCP servers and 20 different DNS servers. If an administrator needs to find out if the 10.50.2.x subnet has any free IP addresses for a new server deployment, they have to manually log into the specific DHCP server in that specific region, check the scope, and then manually cross-reference an outdated Excel spreadsheet.

Microsoft solved this administrative nightmare by introducing IP Address Management (IPAM) in Windows Server. IPAM is a centralized orchestration framework. You install the IPAM role on a single server, and it automatically reaches out across your entire Active Directory domain. It ingests data from every single Microsoft DHCP server, DNS server, and Domain Controller on your network. It consolidates all this data into a single, unified database, allowing administrators to monitor IP address utilization, track MAC addresses across the globe, and even provision new DHCP scopes from a single pane of glass.

Deploying IPAM requires precise execution via PowerShell, particularly when configuring the security policies that allow IPAM to talk to the remote servers.

Step 1: Installing the IPAM Role

You must dedicate a specific server (e.g., IPAM-SRV-01) to this role. Crucial Warning: You cannot install the IPAM role on a Domain Controller. It must be a standalone member server.

Open an elevated PowerShell session on your new server and execute:

Install-WindowsFeature -Name IPAM -IncludeManagementTools

Step 2: Provisioning the IPAM Database

Once the binaries are installed, you must provision the internal database and configure how IPAM will authenticate against all the other servers on the network.

The most secure and automated method is Group Policy Based (GPO) provisioning. Instead of manually adding the IPAM service account to the local Administrators group of 50 different DHCP servers, IPAM will create custom GPOs in Active Directory and apply them automatically.

# 1. Define the GPO Prefix (All IPAM GPOs will start with this name)
$GpoPrefix = "IPAM_Corp_"

# 2. Provision the IPAM framework (This configures the local server and prepares the AD integration)
Invoke-IpamGpoProvisioning -Domain "corp.local" -GpoPrefixName $GpoPrefix -IpamExternalGpoDomain "corp.local" -DelegatedGpoUser "Administrator"

If you open the Group Policy Management Console (GPMC) in Active Directory after running this command, you will see three brand new GPOs created: IPAM_Corp_DHCP, IPAM_Corp_DNS, and IPAM_Corp_DC_NPS.

Step 3: Configuring Server Discovery

The IPAM server is ready, but it doesn’t know where to look. You must tell it which Active Directory domains it is allowed to scan for infrastructure servers.

# Instruct IPAM to scan the corp.local domain, looking specifically for Domain Controllers, DHCP, and DNS servers.
Add-IpamDiscoveryDomain -Name "corp.local" -DiscoverDc $true -DiscoverDhcp $true -DiscoverDns $true

Step 4: Triggering the Discovery Task

IPAM uses background scheduled tasks to perform its scans. To force it to immediately sweep the network and locate every DHCP and DNS server, trigger the discovery task:

Invoke-IpamServerProvisioning -Force

(Note: Depending on the size of your network, this can take several minutes as IPAM queries Active Directory for every registered service endpoint).

Step 5: Managing the Discovered Servers

Once the discovery task completes, the servers are known to IPAM, but they are marked as “Unmanaged.” IPAM will not pull data from them until you explicitly authorize it.

To view the list of all DHCP and DNS servers IPAM found, run:

Get-IpamServerInventory

To bulk-authorize all discovered servers and bring them under centralized management, execute:

Get-IpamServerInventory | Set-IpamServerInventory -ManageabilityStatus Managed

The Final Synchronization

The servers are now managed, and the GPOs are applied. IPAM will now begin securely connecting to the remote servers using WMI and RPC to pull their data.

To force the immediate download of all DHCP scopes, DNS zones, and active IP leases into your centralized IPAM database, run:

Update-IpamServer

Your enterprise IP infrastructure is now completely consolidated. Administrators can use the Server Manager GUI on the IPAM server to instantly search for an IP address and definitively see which DHCP server issued it, which DNS server holds the record, and the exact MAC address of the device using it.