DHCP Client Lease History Win 2012 R2

Question

_{Sunday, June 11, 2017 6:35 PM}

1. Given an IP address, how can I know to which workstations this IP address has ever been assigned within a period of time? What log should I activate on the server, and is there any convenience way for me to see it.

2. From the workstation perspective, how can I know what IP addresses are ever assigned to this workstation by a specific DHCP server and within a period of time?

I have a need to identify an infected host in my network, the only information I have is the IP address but sadly it is obtained from DHCP server and by the time I received the infected hosts list report usually the IP address info is no longer valid. My DHCP lease time is 1 hour. 

Answers to either one or both questions above will be highly appreciated. Please kindly advise.

All replies (3)

_{Monday, June 12, 2017 8:59 AM ✅Answered}

Hi,

If you have DHCP Audit logging enabled you might have the data in the logs.

More information about how to set up DHCP Audit logging, please refer to the following article:

https://technet.microsoft.com/en-us/library/dd759178.aspx?f=255&MSPPError=-2147217396

By default the log files would be located in

C:\windows\System32\Dhcp.

If there is any other concern, please don’t hesitate to let me know.

Best Regards,

Frank

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Tuesday, June 13, 2017 8:17 AM}

Hi Frank,

THanks for your reply. I'll mark it as answer

_{Sunday, January 5, 2020 11:17 AM}

Thank you this was very helpful