If you have DHCP Audit logging enabled (set via DHCP MMC Server properties)
then there are daily log files in the %system32%\dhcp folder.

Depending on what events you have set to audit in your security policy,
there may also be information in the Security Event log allowing you to map
the machine name to an IP.

HTH
Nick Batchelor
Network Manager
The Moat School ~ All dyslexic children can be helped to achieve.

-----Original Message-----
From: Tom Burns [mailto:tburns (at) TorcaUSA (dot) com [email concealed]]
Sent: 13 June 2005 17:41
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: DHCP database

Good morning,

I'm doing a security audit on a PC and need to cross reference what IP
address it had in December. Does anyone know how to look at the old dhcp
database (or any other files) to find out what IP address a computer was
assigned? I have backup tapes of the dhcp server.

The DHCP server is Windows 2000 with SP4.

Tom

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]