Event ID 1060 — DHCP Audit Logging

Applies To: Windows Server 2008

Dynamic Host Configuration Protocol (DHCP) servers include several logging features and server parameters that provide enhanced auditing capabilities. You can specify the following features:

• The file path in which the DHCP server stores audit log files. DHCP audit logs are located by default at %windir%\System32\Dhcp.
• A maximum size restriction (in megabytes) for the total amount of disk space available for all audit log files created and stored by the DHCP service.
• An interval for disk checking that is used to determine how many times the DHCP server writes audit log events to the log file before checking for available disk space on the server.
• A minimum size requirement (in megabytes) for server disk space that is used during disk checking to determine if sufficient space exists for the server to continue audit logging.

Event Details

Resolve

Edit audit log path

DHCP audit log files are located by default at %windir%\System32\Dhcp.

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

To use the DHCP snap-in to modify the folder in which the DHCP server stores audit log files:

1. At the DHCP server, click Start, point to Administrative Tools, and then click DHCP.
2. On the Action menu, click Properties.
3. Click the Advanced tab, and then edit Audit log file path as necessary.

Verify

To verify that the DHCP audit log is functioning correctly:

1. At the DHCP server, click Start, type Windows Explorer in Start Search, and then press ENTER.
2. Navigate the Windows Explorer tree to %windir%\System32\Dhcp.
3. View and record the most recent DHCP log file date stamps. They should be recent. Repeat this process at regular intervals and note whether new events are being logged.

Related Management Information

DHCP Audit Logging

DHCP Infrastructure