Windows server 2008 r2 dhcp server logs of when an ip was leased?

[chamjisky]

Hi
I am working as it level 1 support.
I want  to delete stale reservations from dhcp.

I only have access to it through rsat mmc tools.

Is there any way to find when a particular binding was utilized?  I mean the to find the last date or the number of days an ip address was seen on network?

I will do  delete all reservations that are not used for more then 3 months as a safe limit.

Dhcp server is server 2008 r2.



Sent from my Nexus 5 using Tapatalk

[deanwebb]

Usually, the DHCP MMC tool can show that information: you may need to expand the columns. Certainly, any IP address that is currently not active can be cleared without harm.

What's the reason behind the request to clear the DHCP scope? If you're running out of addresses in that scope, you may need to block traffic from a device that may be requesting more than one address.

[chamjisky]

Usually, the DHCP MMC tool can show that information: you may need to expand the columns. Certainly, any IP address that is currently not active can be cleared without harm.

What's the reason behind the request to clear the DHCP scope? If you're running out of addresses in that scope, you may need to block traffic from a device that may be requesting more than one address.

I have all the fields shown in dhcp mmc.
It only shows active /inactive against a lease. It doesn't shows when it was leased last time.

It shows active if that reservation is utilized at least once. It will be shown active forever..  Even if that device has not contacted the dhcp for years after first contact.

While deleting a lease has no ill affect but it doesn't removes reservation. The reservation still stays there?

I do not want to delete a reservation blindly I want to ensure that its inactive for at least few months.


I need to find a way to identify when a particular binding was utilized last time. Or a list of times in which it was assigned.

Sent from my Nexus 5 using Tapatalk

[deanwebb]

Regarding DHCP reservations... are any of those assigned, or are they all just reservations made by the device? The difference is that one assigned at the server level will be a sort of permanent arrangement, while client-established reservations should get bumped if the range is all used up and you need another address. How big is the DHCP range?

[chamjisky]

Regarding DHCP reservations... are any of those assigned, or are they all just reservations made by the device? The difference is that one assigned at the server level will be a sort of permanent arrangement, while client-established reservations should get bumped if the range is all used up and you need another address. How big is the DHCP range?

There are  a lot of  pools of /24.
Most are almost full.. The reservation is created manually by IT support staff. The never bothered to remove or update these leases.

A client can o ly get in network if there exists a dhcp reservation for it.

Sent from my Nexus 5 using Tapatalk

[deanwebb]

http://social.technet.microsoft.com/wiki/contents/articles/25089.dhcp-on-windows-servers-why-are-the-expired-ip-addresses-not-getting-re-assigned.aspx

http://social.technet.microsoft.com/wiki/contents/articles/25098.how-to-force-a-dhcp-database-cleanup-for-expired-leases-in-a-specific-scope.aspx

Both of those look like they might be able to help out. The second one includes a script for cleaning up the database.

[chamjisky]

http://social.technet.microsoft.com/wiki/contents/articles/25089.dhcp-on-windows-servers-why-are-the-expired-ip-addresses-not-getting-re-assigned.aspx

http://social.technet.microsoft.com/wiki/contents/articles/25098.how-to-force-a-dhcp-database-cleanup-for-expired-leases-in-a-specific-scope.aspx

Both of those look like they might be able to help out. The second one includes a script for cleaning up the database.

We are using 802.1x authentication..
Reservation for Every new computer is created first on dhcp server.  Only then a client can get on network with that ip (after it authenticates using ad usernames and Password).

Duration for lease in my case is unlimited.

All above articles assumes that lease is set to expire. And it plays with grace period on dhcp server to quickly purge expired addresses.

Does windows dhcp server keeps s log of when an ip was assigned?

Sent from my Nexus 5 using Tapatalk

[deanwebb]

Do not use unlimited leases. 802.1X can function just fine without unlimited leases. There should be event logging for DHCP, if I recall. But have the DHCP scope defined to time-out leases.

[chamjisky]

Do not use unlimited leases. 802.1X can function just fine without unlimited leases. There should be event logging for DHCP, if I recall. But have the DHCP scope defined to time-out leases.

Lease time is a discussion for some other post..

For the time being I need to know if windows logs when what ip it leased from its reservations to a clients ip request from dhcp server.. (and do dhcp server logs of a request from Mac address for which there is no binding and hence no ip is assigned by dhcp server ?)


Does enabling dhcp audit allows for above?

Sent from my Nexus 5 using Tapatalk

[deanwebb]

Looks like you want audit logging.

https://technet.microsoft.com/en-us/library/ee941108(v=ws.10).aspx

[chamjisky]

Looks like you want audit logging.

https://technet.microsoft.com/en-us/library/ee941108(v=ws.10).aspx

Does audit logging show at least when an ip was assigned?

Sent from my Nexus 5 using Tapatalk

[deanwebb]

Looks like you want audit logging.

https://technet.microsoft.com/en-us/library/ee941108(v=ws.10).aspx

Does audit logging show at least when an ip was assigned?

Sent from my Nexus 5 using Tapatalk

I would think that it would. Best way to find out is to turn it on.

[chamjisky]

Looks like you want audit logging.

https://technet.microsoft.com/en-us/library/ee941108(v=ws.10).aspx

Does audit logging show at least when an ip was assigned?

Sent from my Nexus 5 using Tapatalk

I would think that it would. Best way to find out is to turn it on.

Any utility to read and properly parse that log rather then scrolling through the text file and searching through it?

I will search for such utilities once I reach home.
If anyone uses such utility please share it..

Sent from my Nexus 5 using Tapatalk