0

My network serves DHCP through a Windows 2022 server. I would like to log the MAC addresses of all devices that acquire an IP address through this DHCP server. I have installed the IPAM role in the server, but I don't understand how to activate the logging. The server is standalone; it does not use Active Directory and it's not connected to a domain.

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
aag
  • 407
  • 1
  • 6
  • 19
  • 1
    ever heard about the eventviewer? – djdomi Jan 01 '22 at 09:25
  • I am unable to find any DHCP loans in the event viewer. What would be the appropriate filter? – aag Jan 01 '22 at 13:04
  • 1
    Every device that has acquired an ip address from the DHCP server will be listed under Leases in the DHCP scope. – joeqwerty Jan 01 '22 at 14:05
  • Do you mean permanent logging? Like a ever growing csv with all the MACs your server has served an IP to? – bjoster Jan 01 '22 at 17:38
  • Yes, exactly. A permanent log. I have seen others asking the same question, but I haven't been able to identify an answer. A combination of IPAM + event viewer was suggested to work, but I don't see how. – aag Jan 01 '22 at 18:14
  • 1
    @djdomi ever looked for something in Windows Event Viewer in recent years? – fraxinus Jan 01 '22 at 18:34
  • @fraxinus daily since as an administrative worker, its my job to view the logs ;) – djdomi Jan 02 '22 at 08:21

1 Answers1

2
Get-DhcpServerv4Lease -ComputerName "dhcpserver.contoso.com" -ScopeId 10.10.10.0

Powershell can do this for you.

Get-DhcpServerv4Lease -ComputerName <MyDHCP> -ScopeId 192.168.0.0

In the output of this function, you will find the MAC address of the clients and the status of the leases as additional information.

This is for real time information.

You can view the logs of past events (once audit logging is enabled) via these steps:

To enable enhanced DHCP logging, perform the following steps:

  1. Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
  2. Right-click the DHCP server, and select Properties from the context menu.
  3. Select the General tab.
  4. Select the "Enable DHCP audit logging" check box

Lots of good information on DHCP audit logs here.

another victim of the mouse
  • 209
  • 1
  • 6
  • 1
    Thanks, appreciated. That works for taking a snapshot of leases at a given time - whereas I am looking for a way to log DHCP leasing events. – aag Jan 01 '22 at 18:16
  • Do you want a consistent log or just to see historical events -- or both? What would the information your looking for look like? – another victim of the mouse Jan 01 '22 at 18:17