Audit DHCP Server log running Windows Server 2008 R2

Audit DHCP Server log running Windows Server 2008 R2

1. Prepare

– DC1 : Domain Controller

– DC2 : DHCP Server

– WIN71, WIN72 : Client

2. Step by step : Audit DHCP Server log on DC2

– DC2 : Enable DHCP audit logging

+ Start – Administrative Tools – DHCP – dc2.pns.vn – Right-click IPv4

– Properties – General tab – Check “Enable DHCP audit logging” – OK

– WIN71, WIN72 : Set recive IP from DHCP

– DC2 : Check DHCP log

+ Windows Explorer – C: drive – Windows – System32 – DHCP – DhcpSrvLog ( Event ID 10 ) :

+ WIN71 : Release IP. Start – cmd – ipconfig /release === check DhcpSrvLog (Event ID 12 )

+ WIN71 : Request IP. Start – cmd – ipconfig /renew === check DhcpSrvLog ( Event ID 10 )

+ IPv4 – Delete 10.0.0.101 WIN72.pns.vn === check DhcpSrvLog ( Event ID 16 )

source

by microsoft lab

windows server dhcp