Note: A Media Access Control (MAC) address or Globally Unique Identifier (GUID) can be present in the log as a client machine unique identifier.
Table 1 Microsoft DHCP Operational Events
1 1008 Search The DHCP service is
shutting down due to the following error: %1
Operational Error The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
2 1016 Search The DHCP service
encountered the following error when backing up the database: %1
Operational Error <13>Feb 20 12:15:47 10.116.28.200 MSWinEventLog 0 System 1339 Tue Feb 20 10:01:30 2007 1016 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 2d 4e 00 00 -N.. The DHCP service encountered the following error when backing up the database: An error occurred while accessing the DHCP database. Look at the DHCP server event log for more information on this error. 845
3 1018 Search The DHCP service failed to restore the database. The following error occurred: %1
Operational Failure The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
4 1019 Search The DHCP service failed to restore the DHCP registry configuration. The following error occurred: %1
Operational Failure The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
5 1020 Search Scope, %1, is %2 percent full with only %3 IP addresses remaining.
Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
6 1023 Search The DHCP service will now terminate because the existing database needs conversion to Windows 2000 format. The conversion via the jetconv process, has initiated. Do not reboot or stop the jetconv process.
The conversion may take up to 10 minutes depending on the size of the database.
Terminate DHCP now by clicking OK. This is required for the database conversion to succeed.
NOTE: The DHCP service will be restarted automatically when the conversion is completed. To check conversion status, look at the Application event log for the jetconv process.
Operational <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10264 Thu Feb 08 10:13:43 2007 1023 DhcpServer Unknown User N/A Information LOGLOGIC-SRV1 None 0000: 00 00 00 00 .... The DHCP service will now terminate because the existing database needs conversion to Windows 2000 format. The conversion via the jetconv process, has initiated. Do not reboot or stop the jetconv process. The conversion may take up to 10 minutes depending on the size of the database. Terminate DHCP now by clicking OK. This is required for the database conversion to succeed.
NOTE: The DHCP service will be restarted automatically when the conversion is completed. To check conversion status, look at theApplication event log for the jetconv process.. 10264
7 1027 Search The audit log file cannot be appended.
Operational <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10264 Thu Feb 08 10:13:43 2007 1027 DhcpServer Unknown User N/A Information LOGLOGIC-SRV1 None 0000: 00 00 00 00 .... The audit log file cannot be appended.. 10264
8 1030 Search The audit log file could not be backed up. The following error occurred: %1
Operational Error The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
9 1040 Search The DHCP service
successfully restored the database.
Operational
Success
<13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10264 Thu Feb 08 10:13:43 2007 1040 DhcpServer Unknown User N/A Information LOGLOGIC-SRV1 None 0000: 00 00 00 00 .... The DHCP service successfully restored the database.
10264
10 1041 Search The DHCP service is not servicing any clients because none of the active network interfaces have statically configured IP addresses, or there are no active interfaces.
Operational Error <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10284 Thu Feb 08 11:04:57 2007 1041 DhcpServer Unknown User N/A Error LOGLOGIC-SRV1 None 0000: 00 00 00 00 ....
The DHCP service is not servicing any clients because none of the active network interfaces have statically configured IP addresses, or there are no active interfaces. 10284
11 1042 Search The DHCP/BINL service
running on this machine has detected a server on the network. If the server does not belong to any domain, the domain is listed as empty. The IP address of the server is listed in
parentheses.%1
Operational <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10264 Thu Feb 08 10:13:43 2007 1040 DhcpServer Unknown User N/A Information LOGLOGIC-SRV1 None 0000: 00 00 00 00 .... The DHCP/BINL service running on this machine has detected a server on the network. If the server does not belong
to any domain, the domain is listed as empty. The IP address of the server is listed in parentheses {10.116.28.94}. 10264
12 1045 Search The DHCP/BINL service on the local machine has determined that it is not authorized to start. It has stopped servicing clients.
The following are some possible reasons for this:
This machine belongs to a workgroup and has encountered another DHCP Server (belonging to a Windows Administrative Domain) servicing the same network. An unexpected network error occurred.
Operational Failure <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1045 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service on the local machine has determined that it is not authorized to start. It has stopped servicing clients. The following are some possible reasons for this: This machine belongs to a workgroup and has encountered another DHCP Server (belonging to a Windows Administrative Domain) servicing the same network. An unexpected network error occurred. 381 Event
13 1046 Search The DHCP/BINL service on the local machine, belonging to the Windows
Administrative domain %2, has determined that it is not authorized to start. It has stopped servicing clients.
The following are some possible reasons for this:
This machine is part of a directory service enterprise and is not authorized in the same domain. (See help on the DHCP Service Management Tool for additional information). This machine cannot reach its directory service enterprise and it has encountered another DHCP service on the network belonging to a directory service enterprise on which the local machine is not authorized. Some unexpected network error occurred.
Operational Failure <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1046 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain loglog.com, has determined that it is not authorized to start. It has stopped servicing clients. The following are some possible reasons for this: This machine is part of a directory service enterprise and is not authorized in the same domain. (See help on the DHCP Service Management Tool for additional information). This machine cannot reach its directory service enterprise and it has encountered another DHCP service on the network belonging to a directory service enterprise on which the local machine is not authorized. Some unexpected network error occurred. 381
14 1051 Search The DHCP/BINL service has determined that it is not authorized to service clients on this network for the Windows domain: %2. All DHCP services that belong to a directory service enterprise must be authorized in the directory service to service clients.
(See help on the DHCP Service Management Tool for authorizing a DHCP server in the directory service).
Operational Failure <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1051 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service has determined that it is not authorized to service clients on this network for the Windows domain:
DNSDHCP.com. All DHCP services that belong to a directory service enterprise must be authorized in the directory service to service clients. 381
15 1052 Search The DHCP/BINL service on this workgroup server has encountered another server with IP Address, %1, belonging to the domain %2.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1052 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service on this workgroup server has encountered another server with IP Address, 10.114.19.29, belonging to the domain DNSDHCP.com. 381
16 1053 Search The DHCP/BINL service on this computer running Windows Server 2003, 2008 for Small Business Server has encountered another server on this network with IP Address, %1, belonging to the domain: %2.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1053 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service on this computer running Windows Server 2003, 2008 for Small Business Server has encountered another server on this network with IP Address, 10.116.24,34, belonging to the domain: DNSDHCP.com. 381
Event
17 1054 Search The DHCP/BINL service on this computer is shutting down. See the previous event log messages for reasons.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1054 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service on this computer is shutting down. See the previous event log messages for reasons. 381
18 1055 Search The DHCP service was
unable to impersonate the credentials necessary for DNS registrations: %1. The local system credentials is being used.
Operational Failure The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
19 1056 Search The DHCP service has
detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service. This is not a recommended security configuration.
Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool.
Operational Error <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10228 Thu Sep 07 12:07:15 2006 1056 DhcpServer Unknown User N/A Warning LOGLOGIC-SRV1 None 0000: 00 00 00 00 ....
The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service. This is not a recommended security configuration. Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool. 10228
20 1066 Search The DHCP/BINL service is not authorized in the directory service domain
"%2" (Server IP Address
%1)
Operational Failure <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1066 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service is not authorized in the directory service domain "DNSDHCP.com" (Server IP Address 10.116.28.27). 381
21 1067 Search The DHCP/BINL service is authorized in the directory service domain "%2" (Server IP Address %1)
Operational
Success
<13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10228 Thu Sep 07 12:07:15 2006 1067 DhcpServer Unknown User N/A Warning LOGLOGIC-SRV1 None 0000: 00 00 00 00 ....
The DHCP/BINL service is authorized in the directory service domain "DNSDHCP.com" (Server IP Address 10.116.28.27).
10228
22 1068 Search The DHCP/BINL service has not determined if it is authorized in directory domain "%2" (Server IP Address %1)
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1068 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP/BINL service has not determined if it is authorized in directory domain "DNSDHCP.com" (Server IP Address 10.116.28.27). 381
23 1075 Search Scope Full%0 Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20011 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... Scope
24 1076 Search Started%0 Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
25 1077 Search Stopped%0 Operational The log format for this event is supported by the LogLogic
Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
26 1080 Search BAD_ADDRESS%0 Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
27 1081 Search This address is already in
use%0 Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1081 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... This address is already in use 10.116.28.77 381
28 1086 Search %%d leases expired and
%%d leases deleted%0 Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
Event ID
Agile Reports /Search
Title/Comments Event Category
Event Type
Sample Log Message
29 1088 Search Microsoft DHCP Service temporarily paused due to low disk space.
10 A new IP address was leased to a client.
11 A lease was renewed not be satisfied because the scope's address pool was exhausted.
15 A lease was denied.
16 A lease was deleted.
17 A lease was expired.
20 A BOOTP address was leased to a client.
21 A dynamic BOOTP address was leased to a client.
22 A BOOTP request could not be satisfied because the scope's
address pool for BOOTP was exhausted.
23 A BOOTP IP address was deleted after checking to see it was to the named DNS server
31 DNS update failed
32 DNS update successful
50+ Codes above 50 are used for Rogue Server Detection information.
ID,Date,Time,Description,IP Address,Host Name,MAC Address
Operational <13>Feb 13 12:30:52 10.116.28.102 MSWinEventLog 0 System 10228 Thu Sep 07 12:07:15 2006 1062 DhcpServer Unknown User N/A Warning LOGLOGIC-SRV1 None 0000: 00 00 00 00 ....
Microsoft DHCP Service Activity Log
Event ID Meaning scope's address pool for BOOTP was exhausted.
23 A BOOTP IP address was deleted after checking to see it
30 1089 Search BOOTP Range Full%0 Operational Success The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
31 1099 Search Authorization succeeded%0 Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
32 1100 Search Server Upgraded%0 Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20011 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... Server Upgraded . 381
33 1101 Search Cached authorization%0 Operational Failure The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
34 1102 Search Authorization failed%0 Operational Success <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20011 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 ....
Authorization failed. 381
35 1103 Search Authorized(servicing)%0 Operational Failure <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 1105 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 ....
Authorized(servicing) server1. 381
36 1104 Search Authorization failure, stopped servicing%0
Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
37 1107 Search Network failure%0 Operational The log format for this event is supported by the LogLogic Appliance, but the event has not been fully validated by LogLogic.
Therefore no sample log message is available. For more information on this event, see the Microsoft Product Documentation.
38 20011 Search The specified address is not available.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20011 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The specified address is not available. 381
39 20012 Search The specified IP address range is full.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20012 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The specified IP address range is full. 381
40 20015 Search The DHCP server received a message that is not valid.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20015 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP server received a message that is not valid. 381 Event
41 20016 Search The DHCP server received a message from a client that is not valid.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20016 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP server received a message from a client that is not valid.
381
42 20017 Search The DHCP server service is paused.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20017 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP server service is paused. 381
43 20034 Search The DHCP service received a request for a valid IP address that is not administered by this server.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20017 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP service received a request for a valid IP address that is not administered by this server. 381
44 20035 Search The DHCP Server failed to receive a notification of interface list changes. Some of the interfaces will not be enabled in the DHCP service.
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20035 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP Server failed to receive a notification of interface list changes. Some of the interfaces will not be enabled in the DHCP service. 381
45 20037 Search The DHCP Server is not servicing any clients on the network because it could not determine if it is authorized to run. This might be due to network problems or insufficient resources.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20037 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP Server is not servicing any clients on the network because it could not determine if it is authorized to run. This might be due to network problems or insufficient resources. 381
46 20038 Search The DHCP service is shutting down because another DHCP server with the IP address %1 is active on the network.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20036 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP service is shutting down because another DHCP server with the IP address 10.116.28.97 is active on the network. 381
47 20040 Search The DHCP service is unable to contact the directory service for domain %1. The DHCP service will continue to attempt to contact the directory service. During this time, no clients on the network will be serviced.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20040 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP service is unable to contact the directory service for domain DNSDHCP.com. The DHCP service will continue to attempt to contact the directory service. During this time, no clients on the network will be serviced. 381
48 20041 Search The DHCP service is not servicing any clients on the network because its authorization information conflicts with another DHCP server whose IP address is
%1 and is active on domain
%2.
Operational Error <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20041 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The DHCP service is not servicing any clients on the network because its authorization information conflicts with another DHCP server whose IP address is 10.116.28.77 and is active on domain DNSDHCP.com. 381
49 20042 Search The DHCP service is ignoring a request from another DHCP service because it is on a different directory service enterprise (Directory Service Enterprise root = %1)
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20042 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The
Operational <13>Feb 16 17:28:16 10.116.28.200 MSWinEventLog 0 System 1099 Fri Feb 16 17:25:23 2007 20042 DhcpServer Unknown User N/A Error LAB-2003-200 None 0000: 00 00 00 00 .... The