Score:0

how to log the MAC addresses of devices acquiring an IP address through DHCP (Windows server 2022)

br flag
aag

My network serves DHCP through a Windows 2022 server. I would like to log the MAC addresses of all devices that acquire an IP address through this DHCP server. I have installed the IPAM role in the server, but I don't understand how to activate the logging. The server is standalone; it does not use Active Directory and it's not connected to a domain.

djdomi avatar
za flag
ever heard about the eventviewer?
aag avatar
br flag
aag
I am unable to find any DHCP loans in the event viewer. What would be the appropriate filter?
joeqwerty avatar
cv flag
Every device that has acquired an ip address from the DHCP server will be listed under Leases in the DHCP scope.
bjoster avatar
cn flag
Do you mean permanent logging? Like a ever growing csv with all the MACs your server has served an IP to?
aag avatar
br flag
aag
Yes, exactly. A permanent log. I have seen others asking the same question, but I haven't been able to identify an answer. A combination of IPAM + event viewer was suggested to work, but I don't see how.
fraxinus avatar
ng flag
@djdomi ever looked for something in Windows Event Viewer in recent years?
djdomi avatar
za flag
@fraxinus daily since as an administrative worker, its my job to view the logs ;)
Score:2
cf flag
Get-DhcpServerv4Lease -ComputerName "dhcpserver.contoso.com" -ScopeId 10.10.10.0

Powershell can do this for you.

Get-DhcpServerv4Lease -ComputerName <MyDHCP> -ScopeId 192.168.0.0

In the output of this function, you will find the MAC address of the clients and the status of the leases as additional information.

This is for real time information.

You can view the logs of past events (once audit logging is enabled) via these steps:

To enable enhanced DHCP logging, perform the following steps:

  1. Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
  2. Right-click the DHCP server, and select Properties from the context menu.
  3. Select the General tab.
  4. Select the "Enable DHCP audit logging" check box

Lots of good information on DHCP audit logs here.

aag avatar
br flag
aag
Thanks, appreciated. That works for taking a snapshot of leases at a given time - whereas I am looking for a way to log DHCP leasing events.
another victim of the mouse avatar
cf flag
Do you want a consistent log or just to see historical events -- or both? What would the information your looking for look like?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.