Is there a way for me to set up DHCP so that only domain devices get an IP Address from a certain subnet, say 192.168.12.x, and other non-domain devices would be assigned to a different subnet?
Edit: I'm currently running Windows Server 2008.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
DHCP on its own isn't capable of this. YaRi's answer doesn't do anything to separate the networks - if you plug a non domain system in to a domain assigned VLAN port you would be on the wrong network.
You could maintain a list of MAC addresses for your domain systems and base your ranges on this (if you aren't in the list, you aren't included in the domain IP range).
If you are serious about this what you really need is a device designed for network access control and supporting the 802.1x protocol. That is probably overkill.
DHCP alone can't do this. However, this can be easily accomplished using NAC (with DHCP pools). NAC (Network Access Control) establishes a network "vestibule" where higher level processes can be applied to move the device into another zone, apply patches, or AV updates, or any number of things. You can spend as much on NAC as you want, but a decent NAC for small businesses is built into windows 2008. In about an hour you can have enough setup to give temporary IP's on a dmz lan for foreign machines, while giving IP's on a private lan for Domain machines.
Yes, you need VLANs. VLAN == subnet. Then set up DHCP scopes and IP address pools for each VLAN.