2

I want to get an audit (event in the event viewer) for every change in the IP address (static or DHCP).

I tried setting an audit configuration on the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces'for set value operation.

When I change the IPAddress in the registry I see an audit entry (event ID 4657) for that change, but when I change the IP address using the properties of the network adapter or using the netsh command no audit on the setting of the new IP address is written to the event log.

Why the change does not appear in the event viewer log?

I tried it on Windows 7 and Windows 2012.

0

You must log in to answer this question.

Browse other questions tagged .