What Windows DHCP Server Logs Record
Windows DHCP server logs capture every major action the service performs. They track server startups and shutdowns, scope activations and deactivations, lease assignments, renewals, releases, and conflicts. When a client requests an address, the server logs the offer and the final acknowledgment. When a lease expires or is denied, that event appears as well. These records let an administrator reconstruct exactly which IP addresses were handed out, to which MAC addresses, and at what times.
More from this site
Keep reading the latest coverage
The logs also record configuration changes, such as when a new scope was added or an existing scope was modified. Critical events like server failures, audit policy changes, and authorization status updates in Active Directory are included too. This makes the log a primary source for both operational troubleshooting and security review.
Where to Find the Logs
By default, Windows DHCP server logs are stored in C:\Windows\System32\dhcp. The files are named DhcpSrvLog-Day.txt, where Day is the current day of the week (Mon through Sun). Each file is a plain-text, tab-delimited log that can be opened in Notepad or any text editor. The DHCP server writes to the daily file and appends events throughout that day.
In addition to the text logs, DHCP events are recorded in the Windows Event Log under Applications and Services Logs → Microsoft → Windows → DHCP-Server. The Event Viewer provides a filtered, searchable view of those entries and is useful when you need to correlate DHCP activity with other system events.
Log Format and Field Meanings
Each line in the DhcpSrvLog text file represents one event. The fields, in order, are: Date, Time, Description, IP Address, MAC Address, Message Type, and additional context such as scope ID or reason code. Understanding these fields is essential for efficient analysis.
- Date and Time — When the event occurred, in local server time.
- IP Address — The address offered, leased, or declined.
- MAC Address — The client hardware identifier.
- Message Type — The action, such as Assign, Renew, Release, Decline, or NAK.
- Scope — The DHCP scope from which the address was drawn.
Common message types include DHCPREQUEST, DHCPACK, DHCPNAK, and DHCPDECLINE. A Decline message is particularly important because it signals that a client detected a duplicate IP on the network, which is often a sign of address conflicts or misconfigured static assignments.
Common Troubleshooting Scenarios
When clients cannot obtain an IP address, the first step is to check the DHCP server logs for scope exhaustion or authorization failures. If the logs show repeated declines from a single MAC address, that client may have a statically assigned IP that overlaps with the DHCP scope. A sudden stop in lease assignments can indicate that the DHCP service stopped, that the server lost its Active Directory authorization, or that the scope was deactivated.
For lease renewal issues, look at the time gap between a Renew request and the corresponding DHCPACK. Long gaps or missing ACK entries suggest network connectivity problems, server overload, or address pool depletion. In multi-server environments, comparing logs across servers helps determine whether failover is working as expected.
Best Practices for Managing DHCP Logs
Keep the DHCP service running on a domain-joined server that is properly authorized in Active Directory, because unauthorized servers are logged and can disrupt address assignment. Enable audit logging through the DHCP console under Properties → Advanced to capture detailed events. Regularly archive old log files and store them for at least 30 days to maintain a usable troubleshooting history. If log volume is high, consider forwarding DHCP events to a central SIEM or log management system so that patterns such as repeated declines or rogue server attempts are easier to spot across multiple servers.