DHCP audit log - Lease denied entry for MAC filtering?

hi folks,

i going enable mac filtering on our w2k8r2sp1 dhcp server weekend.

i've been testing laptop gets denied ip address not on allow list.

i looking entry in audit logs documents event, unable find it.

i looking in appropriate day labeled log file, looking similar event 15 instruction.

https://technet.microsoft.com/en-us/library/dd759178(v=ws.11).aspx

anyone have suggestion how identify when dhcp request denied (with mac filtering enabled)?

hi,

i think event 15 right direction.

according information below, filter more option.

each line record in dhcp audit log corresponding to:

id, date, time, description, ip address, host name, mac address, user name, transactionid,  qresult, probationtime, correlationid, dhcid, vendorclass(hex), vendorclass(ascii), userclass(hex), userclass(ascii), relayagentinformation, dnsregerror.

each item separated comma.

explaine qresult:
0: noquarantine
1:quarantine
2:drop packet
3:probation
6:no quarantine information probationtime:year-month-day hour:minute:second:millisecond.

more information dhcp audit log ,you refer it:

https://social.technet.microsoft.com/forums/windowsserver/en-us/d9a76e4e-debe-44b0-a029-4c7471cc0e97/dhcp-denying-to-lease-ip?forum=winservernis

best regards,

frank

---

please remember mark replies answers if , unmark them if provide no help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  IPAM, DHCP, DNS