How to find out IP address held by a Windows DHCP client yesterday

dhcpdhcp-serveripwindows-server-2008

We have a Windows Server 2008 with DHCP server running.
I can see the current leases and reservations, is there a way to see the status of yesterday (or at least what IP a particular client had yesterday).
I know the odds are it would be the same IP address but given that the client is a laptop and lease time is 4hours…

Best Answer

If you have DHCP Audit logging enabled you might have the data in the logs.

Details on how to set up DHCP Audit Log on Windows Server 2008 including the event types (e.g IP address lease etc)

By default the log files would be located in

%windir%\System32\Dhcp.