I recently had a problem where we were running low on IP addresses. I looked in DHCP and had about 655 active leases over the last 7 days. Now I'm pretty sure I don't have that many devices in the entire school! It turns out that there were a large amount of IPhones and other unauthorized mobile devices attached to our wireless. I guess the kids managed to find out the wireless key again!

There are a number of solutions to this problem, the most obvious is to change our wireless key regularly but I wanted a little more control over who actually connects to our network. I also looked into installing a radius server on our managed wireless but that looked like far too much effort for such a simple problem. Surely I could just ban the MAC addresses of these devices in DHCP.

Unfortunately its not that easy, I looked into DHCP and found out that pre 2008 R2 domain controllers could not filter by MAC address from the server. Shortly after that I was pointed to this page that provides a surprisingly easy solution

DHCP Server Callout DLL for MAC Address based filtering - Microsoft Windows DHCP Team Blog - Site Home - TechNet Blogs

Quick Instructions

Run the 32bit MSI on your domain controller

Browse to windows >> system32 >> dhcp

Edit the maclist.txt file

Manually type in some addresses in this format (you can get the mac address from DHCP, its the Unique ID)

#MACList.txt
MAC_ACTION = {DENY}
#List of MAC Addresses:
00334b141c32     #blahblah-Touch
34339e45190a     #blahblah-iphone

Now simply restart your DHCP server in services and it should start denying all those devices. Easy!