DHCP is inherently insecure. Anyone with access to the network can perform malicious actions that could cause problems for other clients trying to obtain IP addresses. A user could take the following actions:

To reduce the risk of attacks, you should limit physical access to the network. Don't make it easy for unauthorized users to connect to the network. If you use wireless technologies, configure the network so that it doesn't broadcast the service set identifier (SSID) and use Wired Equivalent Privacy (WEP) encryption, which prohibits wireless users from obtaining a DHCP lease until they provide an appropriate WEP key.

To reduce the risk of a rogue DHCP server, configure the Active Directory directory service on the network and use it to determine which DHCP servers are authorized to provide services. By using Active Directory, any computer running Microsoft Windows 2000 or later must be authorized to provide DHCP services. Once a server is authorized, it is available for clients to use. This, unfortunately, doesn't restrict the use of unauthorized Microsoft Windows NT or non-Microsoft servers running DHCP, but it is a start.

In addition, the DHCP Server service should not be placed on an Active Directory domain controller if this can be avoided. The reason for this is because this changes security related to service locator (SRV) records, which domain controllers are responsible for publishing. SRV records detail the location of domain controllers, Kerberos servers, and other servers, and the changes to the security of these records when you install DHCP means that the records could be altered by any client on the network.

The reason this happens is because DHCP servers must be able to update client records dynamically if a client's IP address changes. Because of this, they are made members of the DNSUpdateProxy group, and members of this group do not have any security applied to objects they create in the DNS database. If you can't avoid placing DHCP on a domain controller, it is recommended that you remove the DHCP server from the DNSUpdateProxy group. This should avoid the security problem outlined here, but will also prevent the DHCP server from dynamically updating client records in DNS when the client IP addresses change.