Options

Reservations deleted?

PashPash Member Posts: 1,600 ■■■■■□□□□□
in Net Infra 70-291
Hi,

Does anyone know of a way of seeing if dhcp reservations have been deleted by someone?

I have checked the dhcp logs and cannot see anything obvious.

Seemingly, they just disappeared when some in-house staff were doing work the weekend just gone, I don't think they did just disappear.

Cheers,
DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
· Share on FacebookShare on Twitter

Comments

  • Options
    dynamikdynamik Banned Posts: 12,312 ■■■■■■■■■□
    Hm, you might be able to set up some sort of auditing for that, but if you didn't already have that in place, it's not going to matter now.
    · Share on FacebookShare on Twitter
  • Options
    snadamsnadam Member Posts: 2,234 ■■■■□□□□□□
    dynamik wrote: »
    Hm, you might be able to set up some sort of auditing for that, but if you didn't already have that in place, it's not going to matter now.

    +1 I dont recall any default auditing that monitors erasure of DHCP reservations, or the like. You might be SOL on this one, man.
    **** ARE FOR CHUMPS! Don't be a chump! Validate your material with certguard.com search engine

    :study: Current 2015 Goals: JNCIP-SEC JNCIS-ENT CCNA-Security
    · Share on FacebookShare on Twitter
  • Options
    siniabhilashsiniabhilash Member Posts: 26 ■□□□□□□□□□
    As DHCP admins are the only guys who can fiddle around with the console stuff, your best bet would be to recreate it, in order to find the person who did it ...thats a piece of cake if auditing for local logons are setup in your domain or atleast on the server.

    Regarding the question of knowing if DHCP Reservation have been deleted, i am sure, the only available source of DHCP error finding is through DHCP log, so that might be a good idea to look in the DHCP logging.
    Sini Abhilash
    A+, N+, 270, 290, 291, 299 (MCSA)
    · Share on FacebookShare on Twitter
  • Options
    PashPash Member Posts: 1,600 ■■■■■□□□□□
    Hi Guys,

    Thanks for the response. We do have an events manager server on our network, im not sure if that event type be logged though, I will run through it on Monday.

    I have already tried the dhcp logs but can't find any info on reservation deletion.

    Thanks again,

    Pash
    DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
    · Share on FacebookShare on Twitter
Sign In or Register to comment.