2

We have a machine running Windows Server 2012 that is using DHCP for ip assignment, in an Active Directory network. It is standard protocol for us to use static ip and no one recalls changing this machine.

Is there a way to determine when the LAN adapter configuration was changed from static to DHCP after the fact? It was likely many months ago. (Maybe even forever, possibly someone just never assigned static to begin with.)

matt wilkie
  • 481
  • 1
    How does this help you? What do you hope to accomplish by determining when it changed from static to DHCP? I'm not understanding the value in knowing when this occurred. – joeqwerty Oct 26 '15 at 21:16
  • @joeqwerty knowing when it occurred might tie it to other events in the building, such as who would have been on duty at the time and might have made a change they didn't remember to log, or a coincidence with a period of power outages, etc. If the change was purposeful and I change it back I might break something. It's just due diligence. – matt wilkie Oct 27 '15 at 10:48

1 Answers1

3

Not in the default state. DHCP audit logging is disabled by default (and not retroactive). Security/user audit logging won't show that level of granularity.

Neil
  • 852
  • 1
    Thanks. Info on turning on logging here http://superuser.com/questions/474211/find-all-past-desktop-ip-addresses – matt wilkie Oct 27 '15 at 10:51