Reservations deleted?

Hi,

Does anyone know of a way of seeing if dhcp reservations have been deleted by someone?

I have checked the dhcp logs and cannot see anything obvious.

Seemingly, they just disappeared when some in-house staff were doing work the weekend just gone, I don't think they did just disappear.

Cheers,

Find more posts tagged with

SAVE $250 on Your Microsoft Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Microsoft Boot Camps

Comments

dynamik

Hm, you might be able to set up some sort of auditing for that, but if you didn't already have that in place, it's not going to matter now.

snadam

dynamik wrote: »

Hm, you might be able to set up some sort of auditing for that, but if you didn't already have that in place, it's not going to matter now.

+1 I dont recall any default auditing that monitors erasure of DHCP reservations, or the like. You might be SOL on this one, man.

siniabhilash

As DHCP admins are the only guys who can fiddle around with the console stuff, your best bet would be to recreate it, in order to find the person who did it ...thats a piece of cake if auditing for local logons are setup in your domain or atleast on the server.

Regarding the question of knowing if DHCP Reservation have been deleted, i am sure, the only available source of DHCP error finding is through DHCP log, so that might be a good idea to look in the DHCP logging.

Pash

Hi Guys,

Thanks for the response. We do have an events manager server on our network, im not sure if that event type be logged though, I will run through it on Monday.

I have already tried the dhcp logs but can't find any info on reservation deletion.

Thanks again,

Pash