Skip to main content

How to Get the DHCP Server Address in Batch Script

In a dynamically addressed network, your computer receives its IP address, gateway, and DNS settings from a DHCP (Dynamic Host Configuration Protocol) Server. If your internet is down or you're experiencing IP conflicts, knowing which router or server is assigning your IP is the first step in troubleshooting. A Batch script can query the network configuration to identify the DHCP server's IP address, allowing you to verify if you are connected to the correct network segment or if a "rogue" DHCP server has entered your environment.

This guide will explain how to extract the DHCP server address using Batch.

Method 1: Parsing IPCONFIG (The Direct Way)​

ipconfig /all provides a complete list of network metadata, including the DHCP server for each adapter.

@echo off
setlocal enabledelayedexpansion

echo [NET] Searching for DHCP Server address...
echo.

set "DHCPIP="
set "AdapterName="
set "AdapterCount=0"

:: Parse ipconfig /all - capture adapter names and their DHCP servers
:: Adapter names appear on lines ending with ":"
:: DHCP Server appears indented under each adapter
set "currentAdapter="

for /f "tokens=1* delims=:" %%a in ('ipconfig /all') do (
    set "label=%%a"
    set "value=%%b"

    :: Detect adapter header lines (they have no leading spaces and end before the colon)
    echo "!label!" | findstr /r "adapter" >nul 2>&1
    if !errorlevel! equ 0 (
        set "currentAdapter=!label!"
    )

    :: Look for DHCP Server line
    echo "!label!" | findstr /i /c:"DHCP Server" >nul 2>&1
    if !errorlevel! equ 0 (
        if defined value (
            :: Remove leading space
            set "value=!value:~1!"
            set "DHCPIP=!value!"
            set "AdapterName=!currentAdapter!"
            set /a AdapterCount+=1
            echo [FOUND] !currentAdapter!
            echo         DHCP Server: !value!
            echo.
        )
    )
)

:: Summary
if !AdapterCount! equ 0 (
    echo [INFO] No DHCP Server found.
    echo        This machine is likely using a Static IP configuration.
) else (
    echo [SUMMARY] Found !AdapterCount! adapter(s^) with DHCP.
)

pause
endlocal

Method 2: Adapter-Specific Query (WMIC)​

If you have multiple network cards and want to know specifically which DHCP server is handling a particular adapter, WMIC provides targeted querying.

note

WMIC has been deprecated starting in Windows 11. See Method 3 for a forward-compatible alternative.

@echo off
setlocal enabledelayedexpansion

set "Adapter=Wi-Fi"

echo [QUERY] Checking DHCP for adapter: "%Adapter%"...
echo.

:: Verify the adapter exists
set "found=0"
for /f "tokens=2 delims==" %%n in ('wmic nic get NetConnectionID /value 2^>nul') do (
    for /f "delims=" %%m in ("%%n") do (
        if /i "%%m"=="%Adapter%" set "found=1"
    )
)

if !found! equ 0 (
    echo [ERROR] Adapter "%Adapter%" not found.
    echo.
    echo Available adapters:
    wmic nic where "NetConnectionID is not null" get NetConnectionID 2>nul
    pause
    endlocal
    exit /b 1
)

:: Query the DHCPServer property
:: Must use nicconfig with Index matching the nic's Index
set "DHCPServer="
set "DHCPEnabled="

:: First check if DHCP is enabled on this adapter
for /f "tokens=2 delims==" %%a in ('wmic nicconfig where "Index in (select Index from Win32_NetworkAdapter where NetConnectionID='%Adapter%')" get DHCPEnabled /value 2^>nul') do (
    for /f "delims=" %%b in ("%%a") do set "DHCPEnabled=%%b"
)

if /i "!DHCPEnabled!" neq "TRUE" (
    echo [INFO] DHCP is not enabled on "%Adapter%".
    echo        This adapter is using a static IP configuration.
    pause
    endlocal
    exit /b 0
)

:: Get the DHCP server address
for /f "tokens=2 delims==" %%a in ('wmic nicconfig where "Index in (select Index from Win32_NetworkAdapter where NetConnectionID='%Adapter%')" get DHCPServer /value 2^>nul') do (
    for /f "delims=" %%b in ("%%a") do set "DHCPServer=%%b"
)

if not defined DHCPServer (
    echo [WARN] DHCP is enabled but no server address found.
    echo        The adapter may not have obtained a lease yet.
) else (
    echo [FOUND] DHCP Server for "%Adapter%": !DHCPServer!
)

pause
endlocal
Why the nested FOR loop?

WMIC output appends invisible carriage return characters (\r) to every value. Without stripping them, string comparisons silently fail, i.e. if /i "TRUE\r"=="TRUE" never matches.

Method 3: PowerShell (The Robust Way)​

PowerShell provides dedicated properties for DHCP information, making it immune to locale-dependent string parsing issues and compatible with Windows 11+.

@echo off
setlocal

echo [QUERY] Retrieving DHCP server information...
echo.

powershell -NoProfile -Command ^
  "$adapters = Get-NetIPConfiguration -ErrorAction SilentlyContinue | Where-Object { $_.NetAdapter.Status -eq 'Up' };"^
  "if (-not $adapters) {"^
  "  Write-Host '[INFO] No active network adapters found.';"^
  "  exit 1"^
  "};"^
  "$foundDHCP = $false;"^
  "foreach ($a in $adapters) {"^
  "  $dhcp = $null;"^
  "  try { $dhcp = Get-DhcpServerAddress -InterfaceAlias $a.InterfaceAlias -ErrorAction Stop } catch {};"^
  "  if (-not $dhcp) {"^
  "    try {"^
  "      $config = Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object { $_.InterfaceIndex -eq $a.InterfaceIndex };"^
  "      if ($config.DHCPEnabled -and $config.DHCPServer) {"^
  "        $dhcp = $config.DHCPServer"^
  "      }"^
  "    } catch {}"^
  "  };"^
  "  Write-Host ('  Adapter: ' + $a.InterfaceAlias);"^
  "  Write-Host ('  IPv4:    ' + ($a.IPv4Address.IPAddress -join ', '));"^
  "  if ($dhcp) {"^
  "    if ($dhcp -is [string]) { $dhcpAddr = $dhcp } else { $dhcpAddr = $dhcp.ServerAddress };"^
  "    Write-Host ('  DHCP:    ' + $dhcpAddr);"^
  "    $foundDHCP = $true"^
  "  } else {"^
  "    Write-Host '  DHCP:    Static IP (no DHCP)'"^
  "  };"^
  "  Write-Host ''"^
  "};"^
  "if (-not $foundDHCP) {"^
  "  Write-Host '[INFO] No adapters are using DHCP - all have static configurations.'"^
  "}"

pause
endlocal

Method 4: Rogue DHCP Server Detection​

Compares your current DHCP server against an expected address to detect unauthorized DHCP servers on the network.

@echo off
setlocal enabledelayedexpansion

:: Set your expected/authorized DHCP server(s)
set "ExpectedDHCP=192.168.1.1"

echo [SECURITY] Rogue DHCP Server Check
echo          Expected DHCP server: %ExpectedDHCP%
echo.

set "RogueFound=0"
set "CheckCount=0"

:: Parse all DHCP servers from ipconfig
:: Using tokens=1,* prevents breaking IPv6 addresses which contain colons natively
for /f "tokens=1,* delims=:" %%a in ('ipconfig /all ^| findstr /i /c:"DHCP Server"') do (
    set "dhcp=%%b"
    :: Strip leading spaces safely
    for /f "tokens=*" %%x in ("!dhcp!") do set "dhcp=%%x"
    set /a CheckCount+=1

    if /i "!dhcp!"=="%ExpectedDHCP%" (
        echo [OK]   DHCP Server !dhcp! - matches expected.
    ) else (
        echo [ALERT] ROGUE DHCP DETECTED: !dhcp!
        echo        Expected: %ExpectedDHCP%
        echo        This may indicate an unauthorized device on the network!
        set /a RogueFound+=1
    )
)

echo.

if !CheckCount! equ 0 (
    echo [INFO] No DHCP servers found - all adapters may be on static IPs.
) else if !RogueFound! gtr 0 (
    echo [ALERT] !RogueFound! unauthorized DHCP server^(s^) detected!
    echo         Investigate immediately to prevent IP conflicts and security breaches.
) else (
    echo [OK] All DHCP servers match the expected configuration.
)

pause
endlocal
What is a rogue DHCP server?

If someone plugs a home router into your corporate network, it starts handing out IP addresses from its own range (e.g., 192.168.0.x instead of your corporate 10.0.x.x). Affected machines get wrong IPs, wrong gateways, and wrong DNS, effectively losing network access. This script catches it.

How to Avoid Common Errors​

Wrong Way: Assuming the Gateway is the DHCP Server​

On many home routers, the gateway (e.g., 192.168.1.1) is also the DHCP server. However, on corporate networks, the DHCP server is often a separate Windows Server or a dedicated Linux appliance.

Correct Way: Always query the DHCP Server property specifically. Never assume it's the same as your gateway if you want accurate troubleshooting data.

Wrong Way: Capturing Only One DHCP Server​

A machine with multiple adapters (Wi-Fi + Ethernet + VPN) may have different DHCP servers on each. Using multiple set "DHCPIP=%%a" silently overwrote previous values, reporting only the last one found.

Correct Way: Either display all DHCP servers (Method 1) or specify the exact adapter you're querying (Method 2).

Wrong Way: Using WMIC Output Without Stripping \r​

WMIC appends invisible carriage return characters to every value. String comparisons like if /i "%DHCPEnabled%"=="TRUE" silently fail.

Correct Way: Use a nested FOR /F to strip the trailing characters:

for /f "tokens=2 delims==" %%a in ('wmic ... /value') do (
    for /f "delims=" %%b in ("%%a") do set "var=%%b"
)

Problem: Static IP Configuration​

If a computer has a manually configured static IP, there is no DHCP server address to find. Your variable will be empty.

Solution: Always check if the result is empty and inform the user that the machine is on a static configuration. Method 2 explicitly checks DHCPEnabled before attempting to read the server address.

Problem: Locale-Dependent Parsing​

The string "DHCP Server" in ipconfig /all output is translated in non-English Windows versions (e.g., German: DHCP-Server, French: Serveur DHCP).

Solution: Use PowerShell (Method 3) or WMIC (Method 2), which use standardized property names regardless of system language.

Best Practices and Rules​

1. Identify "Rogue" Servers​

If your computer usually gets an IP from 10.0.0.1 but suddenly reports a DHCP server at 192.168.1.1, someone has plugged an unauthorized router into your network. Method 4 automates this security check.

2. Verify Lease Status​

The DHCP server address is only half the story. Use ipconfig /all to also check the Lease Obtained and Lease Expires timestamps to see if your lease is healthy:

ipconfig /all | findstr /i /c:"Lease"

3. Log the Source​

Log the DHCP server address during network audits. If 10 computers in a department have different DHCP servers, it indicates a misconfigured VLAN or a split-brain networking issue.

4. WMIC Deprecation​

Microsoft has deprecated WMIC starting in Windows 11. For forward-compatible scripts, use PowerShell's Get-CimInstance Win32_NetworkAdapterConfiguration or Get-NetIPConfiguration as shown in Method 3.

5. Multiple Adapters​

Always account for machines with multiple network adapters. A laptop with Wi-Fi, Ethernet, and a VPN adapter may have up to three different DHCP servers. Your script should either enumerate all of them or clearly specify which adapter it's querying.

6. Always Use setlocal / endlocal​

Without setlocal, every variable your script creates persists in the parent shell session, causing potential conflicts when running multiple scripts in sequence.

Conclusions​

Identifying the DHCP server address is a fundamental part of network diagnostics. By moving beyond basic IP checking and pinpointing the source of your network configuration, you gain the ability to resolve complex addressing issues and identify unauthorized hardware. This automated visibility ensures your Windows environment remains securely and correctly connected to the appropriate network infrastructure.

Table of Contents