JSI Tip 3885. How do I enable Windows 2000 DHCP Server logging?

If you need detail DHCP Server logging to assist in troubleshooting:

1. Open the DHCP Administration Tool.

2. Right-click the DHCP Server and press Properties.

3. Select the General tab.

4. Select Enable DHCP Audit Logging.

A DhcpSrvLog.xxx log file will be created in the DHCP database folder, %SystemRoot%system32dhcp.

The event IDs recorded are:

E v e n t
ID Description

00    The log was started.
01    The log was stopped.
02    The log was temporarily paused due to low disk space.
10    A new IP address was leased to a client.
11    A lease was renewed by a client.
12    A lease was released by a client.
13    An IP address was found in use on the network.
14    A lease request could not be satisfied because the address pool of the scope was exhausted.
15    A lease was denied.
16    A lease was deleted.
17    A lease was expired.
20    A BOOTP address was leased to a client.
21    A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
23    A BOOTP IP address was deleted after checking to see it was not in use.
50    Unreachable domain: The DHCP server could not locate the applicable domain for its configured Active Directory installation.
51    Authorization succeeded: The DHCP server was authorized to start on the network.
52    Upgraded to Windows 2000: The DHCP server was recently upgraded to Windows 2000 Server and therefore the unauthorized DHCP server detection feature (used to determine whether the server has been authorized in Active Directory) was disabled.
53    Cached Authorization: The DHCP server was authorized to start using previously cached information. Active Directory was not currently visible at the time the server was started on the network.
54    Authorization failed: The DHCP server was not authorized to start on the network. When this event occurs, it is likely followed by the server being stopped.
55    Authorization (servicing): The DHCP server was successfully authorized to start on the network.
56    Authorization failure, stopped servicing: The DHCP server was not authorized to start on the network and was shut down by Windows 2000 Server. You must first authorize the server in the directory before starting it again.
57    Server found in domain: Another DHCP server using the same IP address or DNS name already exists and is authorized for service in the same Active Directory domain.
58    Server could not find domain: The DHCP server could not locate the specified Active Directory domain.
59    Network failure: A network-related failure prevented the server from determining if it is authorized.
60    No DC is DS Enabled: No Windows 2000 domain controller (DC) was located. For detecting whether the server is authorized, a DC that is enabled for Active Directory is needed.
61    Server found that belongs to DS domain: Another DHCP server was found on the network that belongs to the Active Directory domain.
62    Another server found: Another DHCP server was found on the network.
63    Restarting rogue detection: The DHCP server is trying again to determine whether it is authorized to start and provide service on the network.
64    No DHCP enabled interfaces: The DHCP server has its service bindings or network connections configured so that it is not enabled to provide service.