View old DHCP lease information

Patrick-NJ
Patrick-NJ used Ask the Experts™
on
Hi guys and thanks to anyone who can give me some insight here.

I have someone on my internal network who tried to access my firewall multiple times with different usernames.  It looks like it was about a week ago and the dhcp lease has expired.  I have the ip address, but no computer name.  Is there a way to find this in dhcp logs? Been looking all over with no luck.

Thanks again all
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
You can enable DHCP audit logging:
http://www.windowsnetworking.com/kbase/WindowsTips/WindowsNT/AdminTips/Network/EnableDHCPLogging.html

Possibly you find something in the event logs, looking at dhcp client events.

If you can catch something depends on what you enabled or disabled for the logs.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial