Scribd
Upload
101 views1 page

DHCP Auditing and Event Logging Guide

The document provides guidance on auditing and logging DHCP server events in Windows Server 2008 and above. It describes how to enable DHCP auditing and the types of events logged, such as IP addresses leased or exhausted. It also discusses preventing unauthorized DHCP servers and using IP conflict detection before leasing addresses.

Uploaded by

Crisputin86
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
101 views1 page

DHCP Auditing and Event Logging Guide

The document provides guidance on auditing and logging DHCP server events in Windows Server 2008 and above. It describes how to enable DHCP auditing and the types of events logged, such as IP addresses leased or exhausted. It also discusses preventing unauthorized DHCP servers and using IP conflict detection before leasing addresses.

Uploaded by

Crisputin86
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

Quick Reference Guide

DHCP Auditing and Event Logging Guide


How to audit DHCP server on Windows Server 2008 and above

Enable DHCP Server Auditing List of Events logged


 Open DHCP Microsoft Management Console (MMC) snap-in > In the
console tree click the DHCP server you want to configure > choose IPv4
 10 - new IP address leased
or IPv6 > call menu by right clicking DHCP instance and go to Properties
> On the General tab, select Enable DHCP audit logging > OK  13 - IP address was found in use
 14 - address pool was exhausted
Analyzing DHCP Server Log Files  50 - unreachable domain
 DHCP server log files are configured to manage growth and converse
 54 - DHCP server was not authorized
disk resources. DHCP audit logs are located by default at the following
path %windir%\System32\dhcp  55 - DHCP server was authorized
 62 - another DHCP server was found
DHCP Server Log File Format (IPv4)  64 - no DHCP enabled interfaces
 DHCP server logs are comma-delimited text files with each log entry Complete list of events is available at
representing a single line of text. Following are common fields in a log
http://url2open.com/dhcpevents
file entry:
 ID - A DHCP Server Event ID code
 Date - Date on which entry was logged Enable IP Address
 Time - Time at which entry was logged
 Description - A description of DHCP Server event
Conflict Detection
 IP Address - The IP Address of DHCP client
Feature allows to control how many times
 Host Name - The host name of the DHCP client
DHCP server tests an IP address before
 Mac Address - MAC address used by network adapter hardware
leasing it to a client

Prevent Rogue DHCP Servers  netsh dhcp server set

 Starting from Windows Server 2008 DHCP Server service is integrated detectconflictretry 1
with Active Directory to provide authorization and protect your network When conflict detection is enabled DHCP
from rogue Windows-based DHCP servers server uses the ping process to test
 Following commands used to control authorization for DHCP Servers : available scope of IP addresses before
 netsh dhcp show server lists all authorized DHCP servers including it in DHCP lease offered to
 netsh dhcp add server <ServerDNS> [ServerIP] authorizes DHCP clients.
 netsh dhcp delete server <ServerDNS> [ServerIP] revok es Note: A value of no greater than 2 for
authorization
conflict detection is recommended to
prevent increased load at server
For Detailed Windows Server Auditing,
Try Netwrix Auditor - netwrix.com/go/trial-ws
 Change auditing: detection, reporting and alerting on all
configuration changes across your entire IT infrastructure with Who,
What, When, Where details and Before/After values.
 Predefined reports and dashboards with filtering, grouping,
sorting, export (PDF, XLS etc.), email subscriptions, drill-down, access
via web, granular permissions and ability to create custom reports.
 AuditArchive™: scalable two-tiered storage (file-based + SQL database) Try Windows Server
holding consolidated audit data for 10 years or more. Auditing For Free:
 Unified platform to audit the entire IT infrastructure, unlik e other
netwrix.com/go/trial-ws
vendors with a set of hard-to-integrate standalone tools.

HQ: 300 Spectrum Center Drive, Phone: 1-949-407-5125 Int'l: 1-949-407-5125


Suite 820, Irvine, CA 92618 Toll-free: 888-638-9749 EMEA: 44 (0) 203-318-0261 netwrix.com/social

You might also like