Who Can Install and Authorize a DHCP Server in a Multi-Domain Forest?
Short answer
A Only Admin1, as the Enterprise Admin, can install the DHCP role on Server3 and authorize it in the multi-domain forest's Active Directory.
Question
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Existing Environment
AD DS Environment
The network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.
All the domain controllers are global catalog servers.
Server Infrastructure
The network contains the servers shown in the following table.
A server named Server4 runs Windows Server and is in a workgroup. Windows Defender Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.
Group Policies
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.
Existing Identities
The forest contains the users shown in the following table.
The forest contains the groups shown in the following table.
Current Problems
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed-in user.
Requirements
Technical Requirements
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.
Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.
Ensure that you can run virtual machines on VM1.
Force users to provide credentials when they connect to VM2.
On VM3, enable Data Deduplication on all volumes that support the feature.
You need to meet the technical requirements for Server3.
Which users can perform the required tasks?
Key Takeaways
This question tests the distinction between installing a DHCP role (requires local admin) and authorizing a DHCP server in a multi-domain forest (requires Enterprise Admin), where domain-level admins alone cannot authorize DHCP servers.
In Contoso's two-domain forest (contoso.com and canada.contoso.com), installing and authorizing Server3 as a DHCP server requires both local administrator rights on Server3 and Enterprise Administrator privileges in the forest. Only Admin1, the Enterprise Admin, can complete both the installation and the AD DS authorization of the DHCP server.
Common mistake: Choosing D (Admin1 and Admin3) or E (all three) is a common mistake because learners assume Domain Admins can also authorize a DHCP server in AD DS. In a multi-domain forest, only Enterprise Admins can authorize DHCP servers, so Domain Admins of contoso.com or canada.contoso.com cannot complete the authorization step.
Expert Analysis
Why the Answer Is Correct
Installing the DHCP server role on Server3 requires membership in the local Administrators group on that server, which Admin1 (Enterprise Admin) satisfies. Authorizing a DHCP server in Active Directory creates an object in the Configuration naming context of the forest, and in a multi-domain forest this operation requires Enterprise Administrator privileges. Since Contoso has two domains (contoso.com and canada.contoso.com), the DHCP authorization step demands the highest tier of forest-wide privilege. Admin1 is the only user who can both install the role locally and authorize the server in AD DS, making A the correct answer.
Why the Other Options Are Wrong
Options B, C, and E fail because Admin2 and Admin3 lack Enterprise Admin privileges necessary to authorize a DHCP server in a multi-domain forest. Domain Admins of either contoso.com or canada.contoso.com have administrative control over their own domain but not over the forest-level Configuration partition where DHCP authorization objects are stored. Even if Admin2 or Admin3 could install the DHCP role on Server3 (if they had local admin rights), the authorization step would fail with access-denied errors because it requires Enterprise Admin privileges in this multi-domain forest scenario.
Community Comment Notes
Multiple community members correctly identified the answer as A, with one noting that "Only enterprise admin has ability to install AND authorize." Another commenter referenced Microsoft documentation stating "you must use the Enterprise Administrator account to authorize the DHCP server" in a multi-domain environment. However, one community member disagreed, claiming "Both Enterprise and Domain Admins can install and authorize" — this is incorrect because Domain Admins in a single domain of a multi-domain forest do not have the permissions to authorize DHCP servers at the forest level.
Exam Strategy
Always distinguish between forest-wide operations and domain-wide operations in multi-domain forest scenarios. DHCP authorization, forest-wide FSMO roles, and creating trusts require Enterprise Admin, while domain-level tasks like creating OUs or users only require Domain Admin of the relevant domain.
Frequently Asked Questions
Why can't Domain Admins authorize a DHCP server in a multi-domain forest?
What's the difference between installing and authorizing a DHCP server?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
examtaker2026 👍 1 Answered AIn this scenary, Only Enterprise Admin. "You must authorize the Windows Server DHCP Server role in AD DS before it can begin leasing IP addresses. It's possible to have a single DHCP server providing IP addresses for subnets that contain multiple AD DS domains. Because of this, you must use an Enterprise Administrator account to authorize the DHCP server. In a single-domain environment, membership in Domain Admins is sufficient to authorize a DHCP server." https://learn.microsoft.com/en-us/training/modules/deploy-manage-dynamic-host-configuration-protocol/3-install-configure-dynamic-host-configuration-protocol
-
linux_admin 👍 1 Answered AMeeting the technical requirements for Server3 involves both installing the DHCP role and authorizing the server in Active Directory Domain Services. While child domain administrators have the local rights to install the server role, authorizing a DHCP server requires forest-wide permissions to update the Active Directory Configuration partition. Because default authorization rights are restricted to the Enterprise Admins group, Admin1 is the only user who can complete both required tasks.
-
Gina Lexx 👍 1 Answered DBoth Enterprise and Domain Admins can install and authorize. Can also be delegated.
-
nhlogic 👍 1 Answered AOnly enterprise admin has ability to install AND authorize
-
ab66e9d 👍 1 Answered AAdmin 1 in an enterprise admin
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-802 Questions
Access 125 questions with complete answers and detailed explanations.
View Full AZ-802 Practice Test →