Check that there isn't another authorised DHCP server giving out leases on the same IP range.
Main Topics
Browse All TopicsWe have a Windows 2003 DHCP server and XP clients. All of a sudden yesterday all clients are not able to lease DHCP addresses - event log on the clients shows error 1002 - DHCPNACK received from the server - the DHCP logs on the server show error 15 lease request denied. The scope is not exhausted by a long shot - it just started happening all of a sudden with no changes made that I am aware of - it is not happeneing to a specific client but to my knowledge all of them. It had been working without issue for about a year. Any ideas? I have not found any helpful information in any other articles.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
A tool in the Windows 2003 Support Tools to help find rogue DHCP servers:
Dhcploc.exe
http://technet2.microsoft.
Rogue DHCP: (added to the comments above, please credit the folks who mentioned a rogue DHCP server)
Can you go to the router and mass storage devices and check to see if they are supplying DHCP. Those are the two nodes that most often cause a rougue DHCP server to be active. All Microsoft DHCP servers need to be manually authorized before coming on line. So, you will know when they come on line.
ISA is another culprite that can knock down a DHCP server. ISA has rules that need to be configured to allow DHCP. But, if you are getting a NACK from the server that means your DHCP request from the client is getting through on IP 0.0.0.0 and subnet 255.255.255.255. Since you were able to receive a IP broadcast from the client, ISA may not be the culprite. If you think ISA is underconfigured to provide DHCP, then google search "ISA rules for DHCP". I have seen ISA prevent server replies to client DHCP discoveries.
You should check the server's IP address and make sure it is on the same subnet as the scope of the DHCP service. Regard;ess of what subnet, the DHCP server recieves the discovery from the client on IP 0.0.0.0 and subnet 255.255.255.255. Also make sure the server has a fixed IP that is not in the scope of the DHCP server.
One other think to check is to see if your xp clients have IP version 6 on them.
Last, but not least, the router may have prevented the server from sending a reply back to the client.
Here is a link of folks that had the same error as you that are providing answers.
http://www.eventid.net/dis
Here is the basics of DHCP: (not very basic, but gives you the roots of how DHCP requests traffic). This link may provid you with the ammo to better read the NACK errors in the DHCP logs.
http://support.microsoft.c
I hope this helps
If you ask me, the likelyhood of the problems would be in this order:
1) Rogue DHCP server
2) Router needs to be reset and/or may have lost its settings.
3) ISA server rules for DHCP
4)Server's fixed IP is in the same scope and not an exception of the DHCP server. So a client may be getting that address.
5) Server is on a different subnet.
The network is a multiple VLAN network - 3 VLAN's - server, wired client, wireless client - the DHCP server is statically on the server subnet - its fixed IP is not in any scope - therer are only scopes for the wired and wireless - users have informed me that they are able to lease IP's from the wireless scope, not the wired - I have yet to confirm that - the Cisco layer 3 switches all have the IP of the DHCP server as a helper to forward the DHCP requests - there is no ISA server on the network. I am actually not the "network guy" although I have some experience - I am just not receiving much help at the moment so I am trying to get a solution working on my own. But that's another story :)
Onsite staff came in and did a packet capture using wireshark from a workstation - issues pointed to the core layer 3 switch experincing a broadcast storm of some sort - they did a hard reboot of the switch and the issue resolved itself - in this situation I would say the switch is really the router so ChiefIT's suggestion would be correct.
It's actually something I would have done much sooner if I was on the netowork team and onsite -but in this case my job starts and stops at servers for the most part.
If the problem continues, you might want to check out this article. It may not pertain to you, but could be right up your alley with mass traffic.
http://support.microsoft.c
Business Accounts
Answer for Membership
by: and235100Posted on 2007-12-22 at 11:17:35ID: 20519580
Any help? echnet/sup port/ee/tr ansform.as px? ProdNam e=Windows% 20Operatin g%20System &ProdVer=5 .2&EvtID=1 002& EvtSrc =DHCP&LCID =1033
http://www.microsoft.com/t