How to Configure Windows Server 2016 IPAM Advanced

IP Address Management (IPAM) in Windows Server 2016 provides a centralized platform for discovering, monitoring, auditing, and managing the IP address space and DNS and DHCP servers across your network. The advanced features in Windows Server 2016 IPAM include role-based access control (RBAC), integration with System Center Virtual Machine Manager (SCVMM), enhanced DNS zone management, improved DHCP failover support, and a significantly expanded PowerShell module. This guide covers advanced IPAM configuration including RBAC, DNS integration, and PowerShell management.

Installing IPAM Server

Install the IPAM feature on a dedicated Windows Server 2016 member server that is not a domain controller. Open PowerShell with administrative privileges and install IPAM with management tools:

Install-WindowsFeature -Name IPAM -IncludeManagementTools

Verify the installation:

Get-WindowsFeature -Name IPAM

After installation, open Server Manager and click the IPAM notification to provision the IPAM server by selecting your provisioning method (Group Policy-based or manual). Group Policy-based provisioning is recommended for automated deployment of IPAM access settings to managed servers.

Provisioning IPAM Using Group Policy

Group Policy-based provisioning automatically creates GPOs that configure managed DHCP, DNS, and DC servers to allow IPAM access. Run the provisioning cmdlet, specifying a unique GPO prefix:

Invoke-IpamGpoProvisioning -Domain "contoso.com" -GpoPrefixName "IPAM" -IpamServerFqdn "ipamserver.contoso.com" -DelegatedGpoUser "contosoipadmin" -Confirm:$false

This creates three GPOs named IPAM_DHCP, IPAM_DNS, and IPAM_DC in the domain. Link these GPOs to the appropriate OUs containing your managed servers using the Group Policy Management Console or PowerShell.

Configuring Server Discovery

Configure IPAM to discover DHCP, DNS, and domain controller servers in your environment. Set the discovery scope for the domain:

Set-IpamConfiguration -ServerDiscovery -DiscoveryDomain @{Domain = "contoso.com"; DiscoverDhcp = $true; DiscoverDns = $true; DiscoverDc = $true}

Start server discovery:

Start-IpamServerDiscovery

View discovered servers after discovery completes:

Get-IpamServerInventory | Select-Object Name, ServerType, ManageabilityStatus, AccessStatus

Configuring Role-Based Access Control

IPAM RBAC in Windows Server 2016 allows you to grant different users specific access to IPAM objects such as IP address blocks, DNS zones, and DHCP scopes. View built-in IPAM roles:

Get-IpamRole

Create a custom IPAM role for a team responsible only for managing DHCP scopes:

Add-IpamRole -Name "DHCP_Managers" -Description "Manage DHCP scopes only" -Operations @("GetAddressSpace","ModifyDhcpScope","GetDhcpScope")

View available operations that can be assigned to roles:

Get-IpamOperation

Create an access scope to limit a role to a specific IP range or DNS zone:

Add-IpamAccessScope -Name "Site_A_Scope" -Description "Site A IP ranges"

Create an access policy assigning a role and access scope to a user:

Add-IpamAccessPolicy -PolicyName "Site_A_DHCP_Policy" -RoleAccess @(@{RoleName="DHCP_Managers"; AccessScopeName="Site_A_Scope"}) -UserOrGroupName "contososite_a_admins"

Managing IP Address Blocks and Ranges

Create and manage IP address blocks and ranges using PowerShell. Add an IP address block for a subnet:

Add-IpamBlock -NetworkId "10.10.0.0/16" -Owner "IT Infrastructure" -Description "Corporate LAN" -AddressFamily IPv4

Add a specific IP address range for a department:

Add-IpamRange -NetworkId "10.10.10.0/24" -Owner "Site A" -Description "Site A Desktop Subnet" -AddressFamily IPv4

View all IP address ranges:

Get-IpamRange | Select-Object NetworkId, Owner, PercentageUtilized, AddressesInUse, AddressesFree

Advanced DNS Zone Management with IPAM

IPAM in Windows Server 2016 provides centralized management of DNS zones across multiple DNS servers. Retrieve all DNS zones managed by IPAM:

Get-IpamDnsZone | Select-Object ZoneName, ZoneType, DnsServerName, IsAutoCreated

View DNS resource records for a specific zone:

Get-IpamResourceRecord -ZoneName "contoso.com" -DnsServerName "dc01.contoso.com"

Add a DNS resource record via IPAM:

Add-IpamResourceRecord -ZoneName "contoso.com" -DnsServerName "dc01.contoso.com" -RecordName "webserver" -RecordType A -RecordData "10.10.10.50"

Auditing IP Address Usage

IPAM provides detailed audit tracking of IP address assignment and changes. View IP address audit events:

Get-IpamAddressAuditEvent | Select-Object Timestamp, Address, EventType, UserName, Message | Sort-Object Timestamp -Descending | Select-Object -First 20

Export IPAM configuration and data for backup or reporting:

Export-IpamAddress -AddressFamily IPv4 -Path C:ReportsIPAM_Export.csv

Best Practices for Advanced IPAM

Deploy IPAM on a dedicated server, not on a domain controller or DHCP or DNS server, to separate management functions. Use Group Policy-based provisioning in Active Directory environments for automated and consistent IPAM access configuration. Implement RBAC from the start to ensure that administrators only have access to the IP address ranges and DNS zones relevant to their responsibilities. Schedule regular IPAM database backups using Windows Server Backup. Keep the IPAM server updated with the latest Windows Server patches to receive bug fixes and security improvements. Monitor IPAM audit logs regularly to detect unauthorized IP address changes or deletions. Integrate IPAM with System Center VMM in virtualized environments for coordinated IP address management across physical and virtual networks.

Advanced IPAM configuration on Windows Server 2016 provides a comprehensive IP address management platform that scales from small organizations to large enterprise environments, offering the visibility, control, and audit capabilities needed to manage complex IP address and DNS infrastructure effectively.