0

I have a windows server 2008 R2 standard running our DHCP server. I found out on a specific date that someone downloaded a pirated Movie and in searching the firewall logs I have found the local IP address it came from but I'm having a hard time finding what machine that IP address was on at the time. Is there a way in the DHCP server to find who had an IP address a couple days ago?

2
  • 1
    DHCP audit logging is enabled by default. You can find the DHCP logs at C:\Windows\System32\dhcp.
    – joeqwerty
    Jun 23, 2017 at 18:16
  • Perfect thank! Follow up question, I found the mac address and device name of the person in question. My firewall (WatchGuard x400) will only allow me to blacklist by default and whitelist certain Mac addresses which is not going to be an option. Also, i can blacklist Mac addresses on our Meraki AP's but I think this was done on an old AP (non meraki). My question, is there a way to blacklist a Mac address from the DHCP server?
    – Vdub
    Jun 23, 2017 at 22:04

0

You must log in to answer this question.

Browse other questions tagged .