Audit DHCP Server log running Windows Server 2012 R2

Donate Us : paypal.me/MicrosoftLab

1. Prepare

– DC11 : Domain Controller

– DC12 : DHCP Server

– WIN1091, WIN1092 : Client

2. Step by step : Audit DHCP Server log on DC12

– DC12 : Enable DHCP audit logging

+ Server Manager – Tools – DHCP – DC12.pns.vn – Right-click IPv4

– Properties – General tab – Check “Enable DHCP audit logging” – OK

– WIN1091, WIN1092 : Set recive IP from DHCP

– DC12 : Check DHCP log

+ File Explorer – C: drive – Windows – System32 – DHCP – DhcpSrvLog ( Event ID 10 ) :

+ WIN1091 : Release IP. Start – cmd – ipconfig /release === check DhcpSrvLog (Event ID 12 )

+ WIN1091 : Request IP. Start – cmd – ipconfig /renew === check DhcpSrvLog ( Event ID 10 )

+ IPv4 – Delete 10.0.0.101 WIN1092.pns.vn === check DhcpSrvLog ( Event ID 16 )