Tracing which DHCP IP was given out on a particular date?

[talksr]

Hi there,

 

We have a 2018 server running DHCP to our clients. The lease time is currently set at one hour.

The head has asked me to run some internet activity reports on a particular computer as she believes a staff member has been using the computer for hours and not doing any work related internet activity on it.

Our ISP is LGfL who have a very helpful Internet Activity reporting system, however for this site, my only option is to insert in the computer IP.

 

Is there any way, I can easily ascertain what IP was given to a particular host at a particular time?

 

Thanks in advance.

[Katy]

Usually a device will request the same IP it already has when renewing a lease (which it is then given providing it hasn't already been given out to a different device), so if you are lucky it will have the same IP now as it did then.

 

One hour is incredibly low if it's for anything other than a guest wifi scope, think we have our scopes with PCs on set to the default of 8 days.

[dcwhitworth]

There are DHCP logs in %SystemRoot%\System32\dhcp although if the machine is in frequent use the IP address may well not have changed.

[FN-GM]

If its only an hour and the computer was switched off overnight it will have probably changed.

[fiza]

@talksr - any reason why your lease time is so short?

[talksr]

@talksr - any reason why your lease time is so short?

 

It was something RM changed when the pool size was changed. I guess it could be changed back now. What lease time do you guys have? Thinking seven hrs might be a safer option?

[kennysarmy]

It was something RM changed when the pool size was changed. I guess it could be changed back now. What lease time do you guys have? Thinking seven hrs might be a safer option?

 

8 days on standard VLAN's

 

4 hours on guest network.