# Plan exclusions within a DHCP scope before activating its address range

> How should a DHCP scope represent a subnet with addresses that must not be leased?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-091-plan-exclusions-within-a-dhcp-scope-before-activating-its-address-range/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:15:40+00:00
- Modified: 2026-09-08T18:20:22+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

How should a DHCP scope represent a subnet with addresses that must not be leased?

## Potentially affected

Administrators planning Windows Server DHCP scopes and exclusions.

## DSE recommendation

Prepare an address worksheet showing the overall scope and every intended exclusion.

## Article

## Source facts

A DHCP scope groups addresses that a server can lease to clients on a subnet. Microsoft describes a single scope as an address range together with its configuration options. The Windows Server guidance permits one scope for a subnet, defined as one continuous address range. Administrators needing several usable ranges inside that subnet define the scope first and then add exclusion ranges. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-scopes).

## Applicability

Identify the subnet, proposed pool, existing address allocations, and reservations or exclusions already recorded. Review the addressing plan before enabling the scope, and ask the network owner to resolve conflicting inventory entries.

## DSE recommendation

Prepare an address worksheet showing the overall scope and every intended exclusion. Name the owner of each address block and the reason it is excluded. Have a second reviewer compare the worksheet with the planned configuration and confirm the intended gateway and DNS options separately.

## Verification

Use an approved client test to inspect the assigned address and options. Compare the server’s configured range and exclusions with the worksheet, then reconcile observed leases with the intended eligible addresses. Preserve any unexpected allocation as a finding for investigation before extending the scope to additional clients.

## Official references

[Microsoft Learn: DHCP scopes in Windows Server](https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-scopes). Source reviewed September 8, 2026.

## Primary reference

- Name: DHCP scopes in Windows Server
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-scopes
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan exclusions within a DHCP scope before activating its address range,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-091-plan-exclusions-within-a-dhcp-scope-before-activating-its-address-range/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.