Can you trace the previous IP's in DHCP

  • Thread starter Thread starter Si
  • Start date Start date
S

Si

I have to investigate a student who has been abusing our
network, unfortunately the PC that the little oik was
using, refreshed it's DHCP lease an hour after he had been
surfing the net.

Our webfiltering software only tracks by IP at the moment,
so I was wondering if there is a way of retreiving the
previous ip leases of this particular pc?

Is there a way to set this up so that the system will
record, for example the last three ip addresses give to
the box?
 
The logs are usually written to %Windir%\System32\Dhcp
You can see date, time, IP addresses and MAC addresses from these logs.
There is usualy a new log file for each day of the week like DhcpSrvLog.Wed.
The option "Enable DHCP Audit logging" in DHCP server's properties should be
enabled for this to work.

Dusko Savatovic
 
Hello All,

Yes, that is true. If you know the MAC address, you can search the logs for
that MAC and see what IP address was given at that time.

Shane Brasher
MCSE (2003,2000,NT),MCSA Security, N+, A+
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top