DHCP Approval using Azure Automation and Powershell

I wanted to try to prevent someone from bringing in an unapproved device onto our local network by simply plugging it into an Ethernet jack and pulling an IP address using DHCP. Microsoft's DHCP server service has a feature named DHCP Filters included with the Windows Server DHCP Server service which allows for MAC address white/black listing. I was able to use a combination of various Microsoft and Azure features to automate the process of approving and adding MAC addresses to our whitelist. Below is an explanation of how I was able to achieve this.

Resources needed:
Azure Automation Hybrid Worker agent installed on DHCP server
Azure Automation Runbook with a webhook to start it
Microsoft Power Automation Flow (formerly Microsoft Flow)
Powershell
Windows Task Scheduler
Microsoft Office 365 Outlook and SharePoint

The first step is to configure your Windows Server DHCP service scope so that IP addresses are only provided to computers with MAC addresses in the Allow List. The Deny list is optional:



Next, add a scheduled task on the DHCP server to run every minute which monitors for events indicating that a computer tried to obtain an IP address from the DHCP server but was denied due to not having its MAC address in the Allow list.

The scheduled task should run the Powershell script below every minute. It will pull the latest relevant event from Event Viewer, write the output to an XML file, and email the file to a mailbox for further processing.



The script above generates an XML file containing the computer name and MAC address, writes it to a file then emails it to an email address that can be monitored by a Microsoft Power Automation Flow job. Here's a visual image of the Flow:

Flow Connections needed:
Approvals
Office 365 Outlook
SharePoint


Details of each step in the Flow:






The approval process triggers an email with a link to either deny or approve the request for the computer to obtain an IP address. If you have the Microsoft Power Automation app on your phone you'll also get a push notification to which you can respond deny or approve. The name of the computer is displayed in the email notification and the push notification.

If you approve the request a webhook is fired. The webhook needs to be a link to an Azure Automation runbook which runs on a Hybrid Worker agent installed on the DHCP server. The code for the Runbook is below:

Comments

Post a Comment

Popular posts from this blog

Auto-installing extensions on Firefox using Intune

Image
To build onto my previous blog post concerning ADMX ingestion in Intune to configure Mozilla Firefox settings I'm going to show you how to auto-install extensions in Firefox with Intune. In this example I'm using the uBlock Origin extension as an example. First you'll need to get the URL of the extension. This is different from Chrome where you just need to get the ID of the extension. The easiest way I found to do this is to open Firefox and go to the Extensions Page  at Mozilla and locate the extensions you want to install. Then right-click and copy the link to the "Add to Firefox" button on the extension page. Save the link for later. Now go to the Custom OMA-URI Settings profile in Intune and add a new row. Configure the fields as follows: Name : Extensions_Install OMA-URI (case sensitive):  ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install Data type (String value)*: <enabled/> <data id="
Read more

Disable DNS over HTTPS in Firefox using Intune

Image
Mozilla makes available admx files (Group Policy settings) which allow you to configure some settings in Firefox using Group Policy.  I'm trying to move away from using Group Policy to manage our endpoints since it requires connectivity to a Domain Controller which in turn depends on a VPN connection for remote computers. Too many dependencies there for my taste and Intune makes it much easier to push out changes with the push of a button. This week I've been trying to use a custom configuration profile in Intune to disable DNS over HTTPS on our Windows endpoints. Some of our IPS functionality uses DNS requests to block access to certain websites and DNS over HTTPS makes it easy to bypass that method of content blocking. Intune offers something they call "ADMX ingestion" which sounds weird and biological but basically it just lets you apply Group Policy like functionality using Intune. Making changes to Chrome was easy using this method because Google has a
Read more

Moving Applocker control from Group Policy to Intune

Image
Lately I've been trying to migrate a lot of GPOs to Intune so that our endpoints don't have to depend on a VPN for updating policy. Applocker was an important one for us since VPNs are flaky and it's important that users be able to run updated software while away from the office network. Chrome once updated its signing certificate and because it auto-updates itself we had users who couldn't launch Chrome until they were able to get connected to the VPN and run a gpupdate. I already had the plumbing in place which allows Admins to upload files to a file share and have them automatically added as whitelisted to the Applocker GPO . Now I just had to move the enforcement of the GPO into Intune. I decided to keep the dependency on our Domain Controllers merging the changes into the Applocker policy since there are some pretty good Powershell commands that take care of that. The GPO for Applocker is still being updated but is only used for Intune to pull from and turn int
Read more