How to monitor and audit DHCP Server configuration changes for compliance

  • Article

DHCP Server of Windows Server 2008 R2, supports DHCP activity logging, that is it allows DHCP Administrators to monitor the configuration changes of the DHCP Servers.

Therefore the events pertaining to DHCP activity logging, will be logged with additional information like: Date and time of event occurrence, IP Address and host name of the DHCP Server on which the event occurred and user name of the administrator who made the change.

These events can be seen in the following location in eventviewer:
Applications and Services Logs > Microsoft > Windows > DHCP Server > Microsoft-Windows-DHCP Server Events/Operational

DHCP Administrators would use this feature for network security / IT compliance auditing purposes.
 

Download this tool to directly view all the activity logs in MMC.