Microsoft-Windows-Dhcp-Client

164 events across 3 channels

Event ID	Title	Channel
1000	Your computer has lost the lease to its IP address Address on the Network Card …	Admin
1001	Your computer was not assigned an address from the network (by the DHCP Server) …	Admin
1002	The IP address lease Address1 for the Network Card with network address …	Admin
1003	Your computer was not able to renew its address from the network (from the DHCP …	Admin
1004	Error occurred in stopping the Dhcpv4 Client service.	System
1005	Your computer has detected that the IP address Address for the Network Card with …	Admin
1006	Your computer was unable to automatically configure the IP parameters for the …	Admin
1007	Your computer has automatically configured the IP address for the Network Card …	Admin
1008	Your computer was unable to initialize a Network Interface attached to the …	Admin
1018	Dhcpv6 Initialization has failed on the computer with the error code StatusCode.	System
1019	Unplumbing OLD Config for the adapter: AdapterName.	Operational
1020	Stack Media Connect: AdapterName.	Operational
1021	MEDIA DISCONNECT: Someone still using context.	Operational
1022	Updating Stack with CACHED config Address on AdapterName.	Operational
1023	Updating Stack at address Address on AdapterName.	Operational
1024	Handling ip conflct on AdapterName.	Operational
1025	Waiting for Offer on AdapterName.	Operational
1026	Receiving a DHCP message on AdapterName.	Operational
1027	Received DHCP message on AdapterName is NOT Offer.	Operational
1028	Waiting for ACK on AdapterName.	Operational
1029	Waiting for Renew ACK on AdapterName.	Operational
1030	OBTAIN LEASE - AdapterName: AdapterName Interface LUID: InterfaceLUID.	Operational
1031	DhcpRenewState: DhcpRenewState.	Operational
1032	InitRebootState: InitRebootState.	Operational
1033	DhcpSetGatewaysAndStaticRoutes for the adapter: AdapterName, Error: ErrorCode.	Operational
1034	DhcpDeleteGatewaysAndStaticRoutes for the adapter: AdapterName, Error: …	Operational
1035	Route is added with the values Dest = Address1, DestMask = Address2, NextHop = …	Operational
1036	Route is deleted with the values Dest = Address1, DestMask = Address2, NextHop = …	Operational
1037	Locking Dhcp Context: [AdapterName].	Operational
1038	Unlocking Dhcp Context: [AdapterName].	Operational
1039	Destroying Dhcp Context: [AdapterName].	Operational
1040	Successfully Plumbed the address: Address.	Operational
1041	Successfully Deleted the address: Address.	Operational
1042	Successfully Plumbed the CACHED address using network identifier (Network Hint): …	Operational
1043	DhcpRegReadOptionCache returned ErrorCode.	Operational
1044	RegOpenKeyEx returned ErrorCode.	Operational
1045	Fallback Params Read Fail.	Operational
1046	Successfully read fallback configuration	Operational
1047	RegQueryValueEx returned ErrorCode, Fallback config name type ConfigNameType.	Operational
1048	Registering AdapterName: Registering_AdapterName Address: Address Flags : …	Operational
1049	Deregistering AdapterName: Deregistering_AdapterName.	Operational
1050	Deregistering AdapterName: [Dynamic DNS disabled].	Operational
1051	Failed to Acquire Wcm in Disconnected Standby.	Operational
50001	Media Connect notification received on interface InterfaceId.	Operational
50002	Media Disconnect notification received on interface InterfaceId.	Operational
50003	Media Reconnect notification received on interface InterfaceId.	Operational
50004	DHCP is enabled on the interface with Interface Id InterfaceId.	Operational
50005	DHCP is disabled on the interface with Interface Id InterfaceId.	Operational
50006	Request-Ack is initiated on the interface with Interface Id InterfaceId.	Operational
50007	Discover-Offer-Request-Ack is initiated on the interface with Interface Id …	Operational
50008	Interface is converted from static to DHCP on the interface with Interface Id …	Operational
50009	Discover is sent from the interface InterfaceId.	Operational
50010	Offer is accepted on the interface InterfaceId.	Operational
50011	Offer is discarded on the interface InterfaceId.	Operational
50012	Request is sent from the interface InterfaceId.	Operational
50013	Ack is accepted on the interface InterfaceId.	Operational
50014	Ack is discarded on the interface InterfaceId.	Operational
50015	Nack is received on the interface InterfaceId.	Admin
50016	Unknown message is discarded on the interface InterfaceId.	Operational
50017	Decline is sent on the interface InterfaceId.	Operational
50018	Inform is sent on the interface InterfaceId.	Operational
50019	Release is sent on the interface InterfaceId.	Operational
50020	The broadcast bit was toggled on the interface InterfaceId.	Operational
50021	Error occurred in extracting the options on the interface InterfaceId.	Operational
50022	Setting up a Fallback configuration on interface InterfaceId.	Operational
50023	Offer Receive Timeout has happened on the interface InterfaceId.	Operational
50024	Ack Receive Timeout has happened on the interface InterfaceId.	Operational
50025	Cancelling pending renewals on the interface with the Interface Id InterfaceId.	Operational
50028	Address Address is plumbed on the interface InterfaceId.	Operational
50029	Address Address is unplumbed on the interface InterfaceId.	Operational
50030	Plumbing error has occurred on the interface InterfaceId.	Operational
50032	Lease is expired on the interface InterfaceId.	Operational
50033	An interface is added whose interface index is InterfaceId and Status Code is …	Operational
50034	An error has occurred in initializing the interface InterfaceId.	Admin
50035	Routes are updated on the interface InterfaceId.	Operational
50036	DHCPv4 client service is started	System
50037	DHCPv4 client service is stopped.	System
50038	An error occurred in initializing DHCPv4.	System
50039	An error has occurred in opening the socket on the interface InterfaceId.	Operational
50040	An error has occurred in closing the socket on the interface InterfaceId.	Operational
50041	Domain change notification is received from DNS	Admin
50042	DNS registration has happened for the interface InterfaceId.	Operational
50043	DNS Deregistration has happened for the interface InterfaceId.	Operational
50044	Inform ack is received on the interface InterfaceId.	Operational
50053	A network error occurred when trying to send a message on interface InterfaceId.	Operational
50055	Gateway address Address is reachable on the interface InterfaceId.	Operational
50056	Gateway is not reachable on the interface InterfaceId.	Operational
50058	Your computer was successfully assigned an address from the network, and it can …	Operational
50059	Route is added with the values Dest = Str1, DestMask = Str2, NextHop = Str3, …	Operational
50060	Route is deleted with the values Dest = Str1, DestMask = Str2, NextHop = Str3, …	Operational
50061	An offer is received for the dummy discovers that are sent for Diagnostics on …	Operational
50062	Checking reachability of gateway Address on the the interface InterfaceId.	Operational
50063	DHCP has notified NLA for the configuration changes for the interface …	Operational
50064	DHCP has run the cache scavenger for the interface InterfaceId.	Operational
50065	DHCP has found a match in the cache for Service Set Identifier(SSID) …	Admin
50066	DHCP has plumbed an address using Service Set Identifier(SSID) …	Admin
50067	DHCP has received a Service Set Identifier(SSID) NetworkHintString(Hexadecimal …	Admin
50068	Address Address being plumbed for adapter InterfaceId already exists.	Admin
50069	The broadcast bit BoolFlag was successfully set and cached on the interface …	Operational
50070	DHCP has not received a Service Set Identifier(SSID) for the interface …	Operational
50071	DHCP has not found a match in the cache for Service Set Identifier(SSID) …	Operational
50072	Network Diagnostics Framework(NDF) discovery is being initiated on interface …	Operational
50073	Network Diagnostics Framework(NDF) discovery failed to discover a DHCP server on …	Operational
50074	Firewall port DwordVal is exempted on interface InterfaceId.	Operational
50075	Firewall port DwordVal is closed on interface InterfaceId.	Operational
50076	DHCP has not plumbed an address using Service Set Identifier(SSID) …	Admin
50077	Regular address acquisition will be done on interface InterfaceId because …	Operational
50081	DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER …	Operational
50083	Attempting to acquire a reference for interface InterfaceId.	Operational
50084	Attempting to release the reference for interface InterfaceId.	Operational
50085	Registered duplicate address detection on interface InterfaceId for IP address …	Operational
50086	Completed duplicate address detection on interface InterfaceId for IP address …	Operational
50087	Duplicate address detection on interface InterfaceId for IP address Address …	Operational
50088	Parameter change request registered for process ProcID with descriptor UniqueID.	Operational
50089	Parameter change request unregistered for process ProcID with descriptor …	Operational
50090	Parameter change request notified for process ProcID with descriptor UniqueID.	Operational
50091	Parameter request received on interface with LUID InterfaceLUID.	Operational
50092	Parameter request unblocked on interface with LUID InterfaceLUID and index …	Operational
50093	Parameter request completed on interface with LUID InterfaceLUID and index …	Operational
50094	Firewall port DwordVal1 exemption triggered on interface InterfaceId.	Operational
50095	Firewall port DwordVal1 close triggered on interface InterfaceId.	Operational
50096	DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER …	Operational
50097	DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER …	Operational
50098	DHCP will not try regular IPv4 address acquisition on interface InterfaceId …	Operational
50099	DHCP will try regular IPv4 address acquisition on interface InterfaceId even …	Operational
50100	DHCP will try regular IPv4 address acquisition on interface InterfaceId due to …	Operational
50101	The DHCPv4 client received connected standby entry notification.	Operational
50102	The DHCPv4 client received connected standby exit notification.	Operational
50103	DHCPv4 client registered for shutdown notification	System
50104	DHCPv4 client received shutdown notification	System
50105	DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT	System
50106	DHCPv4 is waiting on DHCPv6 service to stop	System
50107	Firewall port exemption is in progress but incomplete.	Operational
60000	PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId.	Operational
60001	PERFTRACK (DORA): Offer is accepted on the interface InterfaceId.	Operational
60002	PERFTRACK: Gateway is reachable on the interface InterfaceId.	Operational
60003	PERFTRACK: DHCP is not enabled on the interface InterfaceId.	Operational
60004	PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since …	Operational
60005	PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after …	Operational
60006	PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId …	Operational
60007	PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after …	Operational
60010	PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId.	Operational
60011	PERFTRACK (DORA): Offer is accepted on the interface InterfaceId.	Operational
60012	PERFTRACK: Gateway is reachable on the interface InterfaceId.	Operational
60013	PERFTRACK: DHCP is not enabled on the interface InterfaceId.	Operational
60014	PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since …	Operational
60015	PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after …	Operational
60016	PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId …	Operational
60017	PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after …	Operational
60018	PERFTRACK (DHCPv4): Media Connect on interface InterfaceId.	Operational
60019	PERFTRACK (DHCPv4): End of Media Connect on interface InterfaceId.	Operational
60020	PERFTRACK (Media Reconnect): Media reconnect notification was received on …	Operational
60021	PERFTRACK (Discover-DelayedResponse): Offer/Ack is not received for first …	Operational
60022	PERFTRACK (Discover-Timeout): No response is received for all 8 discovers on …	Operational
60023	PERFTRACK (Request-DelayedAck): Ack is not received for first request on …	Operational
60024	PERFTRACK (Request-NoResponse): There is no response for INIT-REBOOT Request on …	Operational
60025	PERFTRACK: Fallback address Address is plumbed on interface InterfaceId after …	Operational
60026	Entered ProcessDhcpRequestForever.	Operational
60027	ProcessDhcpRequestForever Timed out.	Operational
60028	CreateRenewalSignalHandle failed with error StatusCode.	Operational
60029	DeleteRenewTimer failed with error StatusCode.	Operational
60030	ResetRenewalSignalHandle failed with error StatusCode.	Operational
60031	CreateRenewTimer failed with error StatusCode.	Operational
60032	ProcessDhcpRequestForever failed with error StatusCode.	Operational

Event ID 1000 — Your computer has lost the lease to its IP address Address on the Network Card with network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: LostIpAddress

Description

Your computer has lost the lease to its IP address Address on the Network Card with network address HWAddress.

Message #

Your computer has lost the lease to its IP address %1 on the Network Card with network address %3.

Fields #

Name	Description
`Address` UInt32	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 1001 — Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Level: Error
Task: AddressConfigurationStateEvent
Opcode: IpAddressNotAssigned

Message #

Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address %2.  The following error occurred: %3. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Fields #

Name	Description
`HWLength` UInt32	—
`HWAddress` Binary	—
`StatusCode` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1001,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 75,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-13T20:26:34.536116+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "HWLength": 6,
    "HWAddress": "00155D0A1500",
    "StatusCode": 121
  },
  "message": ""
}

Event ID 1002 — The IP address lease Address1 for the Network Card with network address HWAddress has been denied by the DHCP server Address2 (The DHCP Server sent a DHCPNACK message).

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Level: Error
Task: AddressConfigurationStateEvent
Opcode: IpLeaseDenied

Description

The IP address lease Address1 for the Network Card with network address HWAddress has been denied by the DHCP server Address2 (The DHCP Server sent a DHCPNACK message).

Message #

The IP address lease %1 for the Network Card with network address %3 has been denied by the DHCP server %4 (The DHCP Server sent a DHCPNACK message).

Fields #

Name	Description
`Address1` UInt32	—
`HWLength` UInt32	—
`HWAddress` Binary	—
`Address2` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1002,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 76,
    "keywords": 4611686018427387905,
    "time_created": "2023-10-25T22:48:31.191302+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 2312
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Address1": 2182457536,
    "HWLength": 6,
    "HWAddress": "000C29B19818",
    "Address2": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1003 — Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: IpLeaseRenewalFailed

Message #

Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address %2.  The following error occurred: %3. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Fields #

Name	Description
`HWLength` UInt32	—
`HWAddress` Binary	—
`StatusCode` UInt32	—

Event ID 1004 — Error occurred in stopping the Dhcpv4 Client service.

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Task: ServiceStateEvent
Opcode: ErrorServiceStop

Description

Error occurred in stopping the Dhcpv4 Client service. Error code is StatusCode. ShutDown Flag value is DwordVal.

Message #

Error occurred in stopping the Dhcpv4 Client service. Error code is %1. ShutDown Flag value is %2

Fields #

Name	Description
`StatusCode` UInt32	—
`DwordVal` UInt32	—

Event ID 1005 — Your computer has detected that the IP address Address for the Network Card with network address HWAddress is already in use on the network.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: IPConflict

Description

Your computer has detected that the IP address Address for the Network Card with network address HWAddress is already in use on the network. Your computer will automatically attempt to obtain a different address.

Message #

Your computer has detected that the IP address %1 for the Network Card with network address %3 is already in use on the network. Your computer will automatically attempt to obtain a different address.

Fields #

Name	Description
`Address` UInt32	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 1006 — Your computer was unable to automatically configure the IP parameters for the Network Card with the network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: AutoconfigurationFailed

Description

Your computer was unable to automatically configure the IP parameters for the Network Card with the network address HWAddress. The following error occurred during configuration: StatusCode.

Message #

Your computer was unable to automatically configure the IP parameters for the Network Card with the network address %2.  The following error occurred during configuration: %3.

Fields #

Name	Description
`HWLength` UInt32	—
`HWAddress` Binary	—
`StatusCode` UInt32	—

Event ID 1007 — Your computer has automatically configured the IP address for the Network Card with network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: AutoconfigurationSuccess

Description

Your computer has automatically configured the IP address for the Network Card with network address HWAddress. The IP address being used is Address.

Message #

Your computer has automatically configured the IP address for the Network Card with network address %2.  The IP address being used is %3.

Fields #

Name	Description
`HWLength` UInt32	—
`HWAddress` Binary	—
`Address` UInt32	—

Event ID 1008 — Your computer was unable to initialize a Network Interface attached to the system.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: InitNetworkInterfaceFailed

Description

Your computer was unable to initialize a Network Interface attached to the system. The error code is: StatusCode.

Message #

Your computer was unable to initialize a Network Interface attached to the system. The error code is: %1.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 1018 — Dhcpv6 Initialization has failed on the computer with the error code StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Task: AddressConfigurationStateEvent
Opcode: Dhcpv6InitFailed

Description

Dhcpv6 Initialization has failed on the computer with the error code StatusCode. Dhcp service will start with IPv4 only.

Message #

Dhcpv6 Initialization has failed on the computer with the error code %1. Dhcp service will start with IPv4 only.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 1019 — Unplumbing OLD Config for the adapter: AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Unplumbing OLD Config for the adapter: AdapterName.

Message #

Unplumbing OLD Config for the adapter: %1

Fields #

Name	Description
`AdapterName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1019,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.762822+00:00",
    "event_record_id": 45,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 10916
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{b009ef7d-3a19-47a7-aee7-9535aba6a145}"
  },
  "message": ""
}

Event ID 1020 — Stack Media Connect: AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Stack Media Connect: AdapterName. Creating new context.

Message #

Stack Media Connect: %1. Creating new context

Fields #

Name	Description
`AdapterName` UnicodeString	—
`Stack_Media_Connect` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1020,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.399292+00:00",
    "event_record_id": 13,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}"
  },
  "message": ""
}

Event ID 1021 — MEDIA DISCONNECT: Someone still using context.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

MEDIA DISCONNECT: Someone still using context. So not destroying the context.

Message #

MEDIA DISCONNECT: Someone still using context. So not destroying the context

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1021,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:26:50.955986+00:00",
    "event_record_id": 103,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 7364
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1022 — Updating Stack with CACHED config Address on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Updating Stack with CACHED config Address on AdapterName. Error code is ErrorCode.

Message #

Updating Stack with CACHED config %1 on %2. Error code is %3.

Fields #

Name	Description
`Address` UInt32	—
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 1023 — Updating Stack at address Address on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Updating Stack at address Address on AdapterName. Error code is ErrorCode.

Message #

Updating Stack at address %1 on %2. Error code is %3.

Fields #

Name	Description
`Address` UInt32	—
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 1024 — Handling ip conflct on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Handling ip conflct on AdapterName.

Message #

Handling ip conflct on %1.

Fields #

Name	Description
`AdapterName` UnicodeString	—

Event ID 1025 — Waiting for Offer on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Waiting for Offer on AdapterName. Wait time is TimeToWaitLeft milliseconds.

Message #

Waiting for Offer on %1. Wait time is %2 milliseconds

Fields #

Name	Description
`AdapterName` UnicodeString	—
`TimeToWaitLeft` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1025,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.800432+00:00",
    "event_record_id": 53,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{b009ef7d-3a19-47a7-aee7-9535aba6a145}",
    "TimeToWaitLeft": 4984
  },
  "message": ""
}

Event ID 1026 — Receiving a DHCP message on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Receiving a DHCP message on AdapterName. Error code is ErrorCode.

Message #

Receiving a DHCP message on %1. Error code is %2

Fields #

Name	Description
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:34.785631+00:00",
    "event_record_id": 55,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{b009ef7d-3a19-47a7-aee7-9535aba6a145}",
    "ErrorCode": 121
  },
  "message": ""
}

Event ID 1027 — Received DHCP message on AdapterName is NOT Offer.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Received DHCP message on AdapterName is NOT Offer.

Message #

Received DHCP message on %1 is NOT Offer.

Fields #

Name	Description
`AdapterName` UnicodeString	—

Event ID 1028 — Waiting for ACK on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Waiting for ACK on AdapterName.

Message #

Waiting for ACK on %1.

Fields #

Name	Description
`AdapterName` UnicodeString	—

Event ID 1029 — Waiting for Renew ACK on AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Waiting for Renew ACK on AdapterName.

Message #

Waiting for Renew ACK on %1.

Fields #

Name	Description
`AdapterName` UnicodeString	—

Event ID 1030 — OBTAIN LEASE - AdapterName: AdapterName Interface LUID: InterfaceLUID.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

OBTAIN LEASE - AdapterName: AdapterName Interface LUID: InterfaceLUID.

Message #

OBTAIN LEASE - AdapterName: %1 Interface LUID: %2

Fields #

Name	Description
`AdapterName` UnicodeString	—
`InterfaceLUID` HexInt64	—
`OBTAIN_LEASE__AdapterName` UnicodeString	OBTAIN LEASE - AdapterName.
`Interface_LUID` HexInt64	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.777549+00:00",
    "event_record_id": 49,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{b009ef7d-3a19-47a7-aee7-9535aba6a145}",
    "InterfaceLUID": "0x6008005000000"
  },
  "message": ""
}

Event ID 1031 — DhcpRenewState: DhcpRenewState.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

DhcpRenewState: DhcpRenewState.

Message #

DhcpRenewState: %1

Fields #

Name	Description
`DhcpRenewState` UnicodeString	—
`AdapterName` UnicodeString	—

Event ID 1032 — InitRebootState: InitRebootState.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

InitRebootState: InitRebootState.

Message #

InitRebootState: %1

Fields #

Name	Description
`InitRebootState` UnicodeString	—
`AdapterName` UnicodeString	—

Event ID 1033 — DhcpSetGatewaysAndStaticRoutes for the adapter: AdapterName, Error: ErrorCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

DhcpSetGatewaysAndStaticRoutes for the adapter: AdapterName, Error: ErrorCode.

Message #

DhcpSetGatewaysAndStaticRoutes for the adapter: %1,  Error: %2

Fields #

Name	Description
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 1034 — DhcpDeleteGatewaysAndStaticRoutes for the adapter: AdapterName, Error: ErrorCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

DhcpDeleteGatewaysAndStaticRoutes for the adapter: AdapterName, Error: ErrorCode.

Message #

DhcpDeleteGatewaysAndStaticRoutes for the adapter: %1,  Error: %2

Fields #

Name	Description
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 1035 — Route is added with the values Dest = Address1, DestMask = Address2, NextHop = Address3, Address = Address4.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: RouteAdded

Description

Route is added with the values Dest = Address1, DestMask = Address2, NextHop = Address3, Address = Address4.

Message #

Route is added with the values Dest = %1, DestMask = %2, NextHop = %3, Address = %4

Fields #

Name	Description
`Address1` UInt32	—
`Address2` UInt32	—
`Address3` UInt32	—
`Address4` UInt32	—

Event ID 1036 — Route is deleted with the values Dest = Address1, DestMask = Address2, NextHop = Address3, Address = Address4.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: RouteDeleted

Description

Route is deleted with the values Dest = Address1, DestMask = Address2, NextHop = Address3, Address = Address4.

Message #

Route is deleted with the values Dest = %1, DestMask = %2, NextHop = %3, Address = %4

Fields #

Name	Description
`Address1` UInt32	—
`Address2` UInt32	—
`Address3` UInt32	—
`Address4` UInt32	—

Event ID 1037 — Locking Dhcp Context: [AdapterName].

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Locking Dhcp Context: [AdapterName].

Message #

Locking Dhcp Context: [%1]

Fields #

Name	Description
`AdapterName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1037,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:51.250466+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}"
  },
  "message": ""
}

Event ID 1038 — Unlocking Dhcp Context: [AdapterName].

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Unlocking Dhcp Context: [AdapterName].

Message #

Unlocking Dhcp Context: [%1]

Fields #

Name	Description
`AdapterName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1038,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:51.250524+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}"
  },
  "message": ""
}

Event ID 1039 — Destroying Dhcp Context: [AdapterName].

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Destroying Dhcp Context: [AdapterName].

Message #

Destroying Dhcp Context: [%1]

Fields #

Name	Description
`AdapterName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1039,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:51.250530+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "AdapterName": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}"
  },
  "message": ""
}

Event ID 1040 — Successfully Plumbed the address: Address.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Successfully Plumbed the address: Address.

Message #

Successfully Plumbed the address: %1

Fields #

Name	Description
`Address` UInt32	—

Event ID 1041 — Successfully Deleted the address: Address.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Successfully Deleted the address: Address.

Message #

Successfully Deleted the address: %1

Fields #

Name	Description
`Address` UInt32	—

Event ID 1042 — Successfully Plumbed the CACHED address using network identifier (Network Hint): Address.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Successfully Plumbed the CACHED address using network identifier (Network Hint): Address.

Message #

Successfully Plumbed the CACHED address using network identifier (Network Hint): %1

Fields #

Name	Description
`Address` UInt32	—

Event ID 1043 — DhcpRegReadOptionCache returned ErrorCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

DhcpRegReadOptionCache returned ErrorCode.

Message #

DhcpRegReadOptionCache returned %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1044 — RegOpenKeyEx returned ErrorCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

RegOpenKeyEx returned ErrorCode.

Message #

RegOpenKeyEx returned %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1045 — Fallback Params Read Fail.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Fallback Params Read Fail. Error returned is ErrorCode.

Message #

Fallback Params Read Fail. Error returned is %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1046 — Successfully read fallback configuration

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

Successfully read fallback configuration.

Message #

Successfully read fallback configuration

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1046,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.397815+00:00",
    "event_record_id": 11,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1047 — RegQueryValueEx returned ErrorCode, Fallback config name type ConfigNameType.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational

Description

RegQueryValueEx returned ErrorCode, Fallback config name type ConfigNameType.

Message #

RegQueryValueEx returned %1, Fallback config name type %2

Fields #

Name	Description
`ErrorCode` UInt32	—
`ConfigNameType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1047,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.397810+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ErrorCode": 2,
    "ConfigNameType": 0
  },
  "message": ""
}

Event ID 1048 — Registering AdapterName: Registering_AdapterName Address: Address Flags : [AdapterName] Error : Flags.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Registering AdapterName: Registering_AdapterName Address: Address Flags : [AdapterName] Error : Flags.

Message #

Registering AdapterName: %1 Address: %2 Flags : [%3] Error : %4

Fields #

Name	Description
`Registering_AdapterName`	—
`Address` UInt32	—
`AdapterName` UnicodeString	—
`Flags` UInt32	—
`ErrorCode` UInt32	—

Event ID 1049 — Deregistering AdapterName: Deregistering_AdapterName.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Deregistering AdapterName: Deregistering_AdapterName. Errorcode is AdapterName.

Message #

Deregistering AdapterName: %1. Errorcode is %2

Fields #

Name	Description
`Deregistering_AdapterName`	—
`AdapterName` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 1050 — Deregistering AdapterName: [Dynamic DNS disabled].

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Deregistering AdapterName: [Dynamic DNS disabled]. Error is ErrorCode.

Message #

Deregistering AdapterName: [Dynamic DNS disabled]. Error is %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1051 — Failed to Acquire Wcm in Disconnected Standby.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational

Description

Failed to Acquire Wcm in Disconnected Standby. Error is ErrorCode.

Message #

Failed to Acquire Wcm in Disconnected Standby. Error is %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 50001 — Media Connect notification received on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: MediaStateEvent
Opcode: MediaConnect

Description

Media Connect notification received on interface InterfaceId.

Message #

Media Connect notification received on interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 11,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.397033+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 50002 — Media Disconnect notification received on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: MediaStateEvent
Opcode: MediaDisconnect

Description

Media Disconnect notification received on interface InterfaceId.

Message #

Media Disconnect notification received on interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50002,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 12,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:51.250425+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 50003 — Media Reconnect notification received on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: MediaStateEvent
Opcode: MediaReconnect

Description

Media Reconnect notification received on interface InterfaceId.

Message #

Media Reconnect notification received on interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50004 — DHCP is enabled on the interface with Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: DhcpEnabled

Description

DHCP is enabled on the interface with Interface Id InterfaceId.

Message #

DHCP is enabled on the interface with Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50004,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 35,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:07:47.871464+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 7584
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 12
  },
  "message": ""
}

Event ID 50005 — DHCP is disabled on the interface with Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: DhcpDisabled

Description

DHCP is disabled on the interface with Interface Id InterfaceId.

Message #

DHCP is disabled on the interface with Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50005,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 36,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.397793+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 50006 — Request-Ack is initiated on the interface with Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: InitRequestAck

Description

Request-Ack is initiated on the interface with Interface Id InterfaceId.

Message #

Request-Ack is initiated on the interface with Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50007 — Discover-Offer-Request-Ack is initiated on the interface with Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: InitDORA

Description

Discover-Offer-Request-Ack is initiated on the interface with Interface Id InterfaceId.

Message #

Discover-Offer-Request-Ack is initiated on the interface with Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50007,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 17,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:24:29.781267+00:00",
    "event_record_id": 51,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 50008 — Interface is converted from static to DHCP on the interface with Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: StaticToDhcp

Description

Interface is converted from static to DHCP on the interface with Interface Id InterfaceId.

Message #

Interface is converted from static to DHCP on the interface with Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50009 — Discover is sent from the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: DiscoverSent

Description

Discover is sent from the interface InterfaceId. Status code is StatusCode.

Message #

Discover is sent from the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50009,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 18,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.800418+00:00",
    "event_record_id": 52,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18,
    "StatusCode": 0
  },
  "message": ""
}

Event ID 50010 — Offer is accepted on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: OfferReceived

Description

Offer is accepted on the interface InterfaceId. Offered Address is Address1. Server address is Address2.

Message #

Offer is accepted on the interface %1. Offered Address is %2. Server address is %3

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 50011 — Offer is discarded on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: OfferDiscarded

Description

Offer is discarded on the interface InterfaceId. Error code is StatusCode.

Message #

Offer is discarded on the interface %1. Error code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50012 — Request is sent from the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: RequestSent

Description

Request is sent from the interface InterfaceId. Status code is StatusCode.

Message #

Request is sent from the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50013 — Ack is accepted on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AckReceived

Description

Ack is accepted on the interface InterfaceId. Received Address is Address1. Server address is Address2.

Message #

Ack is accepted on the interface %1. Received Address is %2. Server address is %3

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 50014 — Ack is discarded on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AckDiscarded

Description

Ack is discarded on the interface InterfaceId. Error code is StatusCode.

Message #

Ack is discarded on the interface %1. Error code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50015 — Nack is received on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: ProtocolStateEvent
Opcode: NackReceived

Description

Nack is received on the interface InterfaceId.

Message #

Nack is received on the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50016 — Unknown message is discarded on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: UnknownMessageDiscarded

Description

Unknown message is discarded on the interface InterfaceId.

Message #

Unknown message is discarded on the interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50017 — Decline is sent on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: DeclineSent

Description

Decline is sent on the interface InterfaceId. Status code is StatusCode.

Message #

Decline is sent on the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50018 — Inform is sent on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: InformSent

Description

Inform is sent on the interface InterfaceId. Status code is StatusCode.

Message #

Inform is sent on the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50019 — Release is sent on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: ReleaseSent

Description

Release is sent on the interface InterfaceId. Status code is StatusCode.

Message #

Release is sent on the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50020 — The broadcast bit was toggled on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: BroadcastbitToggled

Description

The broadcast bit was toggled on the interface InterfaceId. The broadcast bit after toggling is BoolFlag.

Message #

The broadcast bit was toggled on the interface %1. The broadcast bit after toggling is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`BoolFlag` Boolean	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50020,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 29,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:25:34.446170+00:00",
    "event_record_id": 74,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18,
    "BoolFlag": true
  },
  "message": ""
}

Event ID 50021 — Error occurred in extracting the options on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: ErrorExtractingOptions

Description

Error occurred in extracting the options on the interface InterfaceId. Status code is StatusCode.

Message #

Error occurred in extracting the options on the interface %1. Status code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50022 — Setting up a Fallback configuration on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: FallbackConfigSet

Description

Setting up a Fallback configuration on interface InterfaceId. The Fallback address Address is set. The status code is StatusCode.

Message #

Setting up a Fallback configuration on interface %1. The Fallback address %2 is set. The status code is %3

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` UInt32	—
`StatusCode` UInt32	—

Event ID 50023 — Offer Receive Timeout has happened on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Warning
Task: ProtocolStateEvent
Opcode: OfferReceiveTimeout

Description

Offer Receive Timeout has happened on the interface InterfaceId.

Message #

Offer Receive Timeout has happened on the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50023,
    "version": 0,
    "level": 3,
    "task": 2,
    "opcode": 31,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:34.785664+00:00",
    "event_record_id": 56,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 50024 — Ack Receive Timeout has happened on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AckReceiveTimeout

Description

Ack Receive Timeout has happened on the interface InterfaceId.

Message #

Ack Receive Timeout has happened on the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50025 — Cancelling pending renewals on the interface with the Interface Id InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: CancelRenewal

Description

Cancelling pending renewals on the interface with the Interface Id InterfaceId.

Message #

Cancelling pending renewals on the interface with the Interface Id %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50025,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 33,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:51.250447+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 50028 — Address Address is plumbed on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Collection Priority: Recommended (JSCU-NL)
Task: AddressConfigurationStateEvent
Opcode: AddressPlumbed

Description

Address Address is plumbed on the interface InterfaceId. Status code is StatusCode.

Message #

Address %1 is plumbed on the interface %2. Status code is %3

Fields #

Name	Description
`Address` UInt32	—
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50029 — Address Address is unplumbed on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: AddressUnplumbed

Description

Address Address is unplumbed on the interface InterfaceId. Status code is StatusCode.

Message #

Address %1 is unplumbed on the interface %2. Status code is %3

Fields #

Name	Description
`Address` UInt32	—
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50030 — Plumbing error has occurred on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PlumbingError

Description

Plumbing error has occurred on the interface InterfaceId. Status Code is StatusCode.

Message #

Plumbing error has occurred on the interface %1. Status Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50032 — Lease is expired on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: LeaseExpired

Description

Lease is expired on the interface InterfaceId. Expired address is Address.

Message #

Lease is expired on the interface %1. Expired address is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` UInt32	—

Event ID 50033 — An interface is added whose interface index is InterfaceId and Status Code is StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: MediaStateEvent
Opcode: InterfaceAdded

Description

An interface is added whose interface index is InterfaceId and Status Code is StatusCode.

Message #

An interface is added whose interface index is %1 and Status Code is %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50033,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 46,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:18:54.399285+00:00",
    "event_record_id": 12,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 4,
    "StatusCode": 0
  },
  "message": ""
}

Event ID 50034 — An error has occurred in initializing the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: ErrorInitializeInterface

Description

An error has occurred in initializing the interface InterfaceId. Error Code is StatusCode.

Message #

An error has occurred in initializing the interface %1. Error Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50035 — Routes are updated on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: RouteUpdated

Description

Routes are updated on the interface InterfaceId. Status Code is StatusCode.

Message #

Routes are updated on the interface %1. Status Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50036 — DHCPv4 client service is started

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceStart

Description

DHCPv4 client service is started.

Message #

DHCPv4 client service is started

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50036,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 68,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-06T06:25:39.972933+00:00",
    "event_record_id": 1675,
    "correlation": {},
    "execution": {
      "process_id": 2372,
      "thread_id": 2408
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 50037 — DHCPv4 client service is stopped.

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceStop

Description

DHCPv4 client service is stopped. ShutDown Flag value is DwordVal.

Message #

DHCPv4 client service is stopped. ShutDown Flag value is %1

Fields #

Name	Description
`DwordVal` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50037,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 69,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:31:37.010108+00:00",
    "event_record_id": 1858,
    "correlation": {},
    "execution": {
      "process_id": 2232,
      "thread_id": 2328
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "DwordVal": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 50038 — An error occurred in initializing DHCPv4.

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Task: ServiceStateEvent
Opcode: ErrorInitService

Description

An error occurred in initializing DHCPv4. Error Code is StatusCode.

Message #

An error occurred in initializing DHCPv4. Error Code is %1

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 50039 — An error has occurred in opening the socket on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: WinsockStateEvent
Opcode: ErrorOpeningSocket

Description

An error has occurred in opening the socket on the interface InterfaceId. Error Code is StatusCode.

Message #

An error has occurred in opening the socket on the interface %1. Error Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50040 — An error has occurred in closing the socket on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: WinsockStateEvent
Opcode: ErrorClosingSocket

Description

An error has occurred in closing the socket on the interface InterfaceId. Error Code is StatusCode.

Message #

An error has occurred in closing the socket on the interface %1. Error Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50041 — Domain change notification is received from DNS

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Level: Informational
Task: DNSStateEvent
Opcode: DomainChangeNotification

Description

Domain change notification is received from DNS.

Message #

Domain change notification is received from DNS

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50041,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 71,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-26T04:17:38.252255+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2228,
      "thread_id": 2320
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Admin",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50042 — DNS registration has happened for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: DNSStateEvent
Opcode: DnsRegistrationDone

Description

DNS registration has happened for the interface InterfaceId. Status Code is StatusCode. DNS Flag settings is Dword.

Message #

DNS registration has happened for the interface %1. Status Code is %2. DNS Flag settings is %3.

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—
`Dword` UInt32	—

Event ID 50043 — DNS Deregistration has happened for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: DNSStateEvent
Opcode: DnsDeregistrationDone

Description

DNS Deregistration has happened for the interface InterfaceId. Status Code is StatusCode.

Message #

DNS Deregistration has happened for the interface %1. Status Code is %2

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50044 — Inform ack is received on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: InformAckReceived

Description

Inform ack is received on the interface InterfaceId.

Message #

Inform ack is received on the interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50053 — A network error occurred when trying to send a message on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: NetworkError

Description

A network error occurred when trying to send a message on interface InterfaceId. The error code is: StatusCode.

Message #

A network error occurred when trying to send a message on interface %1. The error code is: %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50055 — Gateway address Address is reachable on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: GatewayReachable

Description

Gateway address Address is reachable on the interface InterfaceId.

Message #

Gateway address %1 is reachable on the interface %2

Fields #

Name	Description
`Address` UInt32	—
`InterfaceId` UInt32	—

Event ID 50056 — Gateway is not reachable on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: GatewayUnreachable

Description

Gateway is not reachable on the interface InterfaceId.

Message #

Gateway is not reachable on the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50058 — Your computer was successfully assigned an address from the network, and it can now connect to other computers.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: SuccessfulLease

Description

Your computer was successfully assigned an address from the network, and it can now connect to other computers.

Message #

Your computer was successfully assigned an address from the network, and it can now connect to other computers.

Event ID 50059 — Route is added with the values Dest = Str1, DestMask = Str2, NextHop = Str3, Address = Str4.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: RouteAdded

Description

Route is added with the values Dest = Str1, DestMask = Str2, NextHop = Str3, Address = Str4.

Message #

Route is added with the values Dest = %1, DestMask = %2, NextHop = %3, Address = %4

Fields #

Name	Description
`Str1` UnicodeString	—
`Str2` UnicodeString	—
`Str3` UnicodeString	—
`Str4` UnicodeString	—

Event ID 50060 — Route is deleted with the values Dest = Str1, DestMask = Str2, NextHop = Str3, Address = Str4.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: RouteDeleted

Description

Route is deleted with the values Dest = Str1, DestMask = Str2, NextHop = Str3, Address = Str4.

Message #

Route is deleted with the values Dest = %1, DestMask = %2, NextHop = %3, Address = %4

Fields #

Name	Description
`Str1` UnicodeString	—
`Str2` UnicodeString	—
`Str3` UnicodeString	—
`Str4` UnicodeString	—

Event ID 50061 — An offer is received for the dummy discovers that are sent for Diagnostics on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: OfferReceivedForDiagnostics

Description

An offer is received for the dummy discovers that are sent for Diagnostics on the interface InterfaceId.

Message #

An offer is received for the dummy discovers that are sent for Diagnostics on the interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50062 — Checking reachability of gateway Address on the the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: StartGatewayReachabilityTest

Description

Checking reachability of gateway Address on the the interface InterfaceId.

Message #

Checking reachability of gateway %1 on the the interface %2

Fields #

Name	Description
`Address` UInt32	—
`InterfaceId` UInt32	—

Event ID 50063 — DHCP has notified NLA for the configuration changes for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: NLANotified

Description

DHCP has notified NLA for the configuration changes for the interface InterfaceId.

Message #

DHCP has notified NLA for the configuration changes for the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50063,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 53,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:25:34.446138+00:00",
    "event_record_id": 73,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 50064 — DHCP has run the cache scavenger for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: CacheScavengerRun

Description

DHCP has run the cache scavenger for the interface InterfaceId.

Message #

DHCP has run the cache scavenger for the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50065 — DHCP has found a match in the cache for Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network addres...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: NetworkHintMatchFound

Description

DHCP has found a match in the cache for Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress.

Message #

DHCP has found a match in the cache for Service Set Identifier(SSID) %1(Hexadecimal value of SSID: %2) for the Network Card with the network address %4

Fields #

Name	Description
`NetworkHintString` UnicodeString	—
`NetworkHint` UnicodeString	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 50066 — DHCP has plumbed an address using Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: MatchedAddressPlumbed

Description

DHCP has plumbed an address using Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress.

Message #

DHCP has plumbed an address using Service Set Identifier(SSID) %1(Hexadecimal value of SSID: %2) for the Network Card with the network address %4

Fields #

Name	Description
`NetworkHintString` UnicodeString	—
`NetworkHint` UnicodeString	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 50067 — DHCP has received a Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: NetworkHintReceived

Description

DHCP has received a Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress.

Message #

DHCP has received a Service Set Identifier(SSID) %1(Hexadecimal value of SSID: %2) for the Network Card with the network address %4

Fields #

Name	Description
`NetworkHintString` UnicodeString	—
`NetworkHint` UnicodeString	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 50068 — Address Address being plumbed for adapter InterfaceId already exists.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: AddressAlreadyExists

Description

Address Address being plumbed for adapter InterfaceId already exists.

Message #

Address %1 being plumbed for adapter %2 already exists

Fields #

Name	Description
`Address` UInt32	—
`InterfaceId` UInt32	—

Event ID 50069 — The broadcast bit BoolFlag was successfully set and cached on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: BroadcastbitCached

Description

The broadcast bit BoolFlag was successfully set and cached on the interface InterfaceId.

Message #

The broadcast bit %1 was successfully set and cached on the interface %2

Fields #

Name	Description
`BoolFlag` Boolean	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50069,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 87,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:26:34.536775+00:00",
    "event_record_id": 94,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "BoolFlag": false,
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 50070 — DHCP has not received a Service Set Identifier(SSID) for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: NetworkHintNotReceived

Description

DHCP has not received a Service Set Identifier(SSID) for the interface InterfaceId.

Message #

DHCP has not received a Service Set Identifier(SSID) for the interface %1

Fields #

Name	Description
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50070,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 88,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.762788+00:00",
    "event_record_id": 44,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 10916
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 50071 — DHCP has not found a match in the cache for Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: NetworkHintMatchNotFound

Description

DHCP has not found a match in the cache for Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the interface InterfaceId.

Message #

DHCP has not found a match in the cache for Service Set Identifier(SSID) %1(Hexadecimal value of SSID: %2) for the interface %3

Fields #

Name	Description
`NetworkHintString` UnicodeString	—
`NetworkHint` UnicodeString	—
`InterfaceId` UInt32	—

Event ID 50072 — Network Diagnostics Framework(NDF) discovery is being initiated on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: DiagnosticsInitiated

Description

Network Diagnostics Framework(NDF) discovery is being initiated on interface InterfaceId.

Message #

Network Diagnostics Framework(NDF) discovery is being initiated on interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50073 — Network Diagnostics Framework(NDF) discovery failed to discover a DHCP server on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: DiagnosticsFailed

Description

Network Diagnostics Framework(NDF) discovery failed to discover a DHCP server on interface InterfaceId.

Message #

Network Diagnostics Framework(NDF) discovery failed to discover a DHCP server on interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50074 — Firewall port DwordVal is exempted on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: FirewallPortExempted

Description

Firewall port DwordVal is exempted on interface InterfaceId. Error code is DwordVal1.

Message #

Firewall port %1 is exempted on interface %2. Error code is %3.

Fields #

Name	Description
`DwordVal` UInt32	—
`InterfaceId` UInt32	—
`DwordVal1` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50074,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 92,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.809876+00:00",
    "event_record_id": 54,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3664
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "DwordVal": 68,
    "InterfaceId": 18,
    "DwordVal1": 0
  },
  "message": ""
}

Event ID 50075 — Firewall port DwordVal is closed on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: FirewallPortClosed

Description

Firewall port DwordVal is closed on interface InterfaceId. Error code is DwordVal1.

Message #

Firewall port %1 is closed on interface %2. Error code is %3.

Fields #

Name	Description
`DwordVal` UInt32	—
`InterfaceId` UInt32	—
`DwordVal1` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50075,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 93,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:26:34.580885+00:00",
    "event_record_id": 97,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3664
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "DwordVal": 68,
    "InterfaceId": 18,
    "DwordVal1": 0
  },
  "message": ""
}

Event ID 50076 — DHCP has not plumbed an address using Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address ...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Admin
Task: AddressConfigurationStateEvent
Opcode: MatchedAddressNotPlumbed

Description

DHCP has not plumbed an address using Service Set Identifier(SSID) NetworkHintString(Hexadecimal value of SSID: NetworkHint) for the Network Card with the network address HWAddress since the lease has expired.

Message #

DHCP has not plumbed an address using Service Set Identifier(SSID) %1(Hexadecimal value of SSID: %2) for the Network Card with the network address %4 since the lease has expired

Fields #

Name	Description
`NetworkHintString` UnicodeString	—
`NetworkHint` UnicodeString	—
`HWLength` UInt32	—
`HWAddress` Binary	—

Event ID 50077 — Regular address acquisition will be done on interface InterfaceId because aggressive address acquisition is turned ON.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AggressiveRetryOn

Description

Regular address acquisition will be done on interface InterfaceId because aggressive address acquisition is turned ON.

Message #

Regular address acquisition will be done on interface %1 because aggressive address acquisition is turned ON.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50081 — DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER transmissions on interface InterfaceId because the machine is in Connected Standby state...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AbandonDiscovInCSSinceDhcp

Description

DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER transmissions on interface InterfaceId because the machine is in Connected Standby state and the interface has the DHCP IPv6 address Address.

Message #

DHCP has cancelled IPv4 address acquisition cycle after %1 DISCOVER transmissions on interface %2 because the machine is in Connected Standby state and the interface has the DHCP IPv6 address %3.

Fields #

Name	Description
`DwordVal1` UInt32	—
`InterfaceId` UInt32	—
`Address` Binary	—

Event ID 50083 — Attempting to acquire a reference for interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: MediaStateEvent
Opcode: AcquireNICReference

Description

Attempting to acquire a reference for interface InterfaceId. Error code is StatusCode.

Message #

Attempting to acquire a reference for interface %1. Error code is %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50084 — Attempting to release the reference for interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: MediaStateEvent
Opcode: ReleaseNICReference

Description

Attempting to release the reference for interface InterfaceId. Error code is StatusCode.

Message #

Attempting to release the reference for interface %1. Error code is %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 50085 — Registered duplicate address detection on interface InterfaceId for IP address Address.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: RegisterConflictDetectionNotification

Description

Registered duplicate address detection on interface InterfaceId for IP address Address.

Message #

Registered duplicate address detection on interface %1 for IP address %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` UInt32	—

Event ID 50086 — Completed duplicate address detection on interface InterfaceId for IP address Address.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: ConflictDetectionComplete

Description

Completed duplicate address detection on interface InterfaceId for IP address Address. Error code is StatusCode.

Message #

Completed duplicate address detection on interface %1 for IP address %2. Error code is %3.

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` UInt32	—
`StatusCode` UInt32	—

Event ID 50087 — Duplicate address detection on interface InterfaceId for IP address Address timed out - reattempting.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: ConflictDetectionTentative

Description

Duplicate address detection on interface InterfaceId for IP address Address timed out - reattempting.

Message #

Duplicate address detection on interface %1 for IP address %2 timed out - reattempting.

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` UInt32	—

Event ID 50088 — Parameter change request registered for process ProcID with descriptor UniqueID.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: NetworkParameterStateEvent
Opcode: ParamChangeRegister

Description

Parameter change request registered for process ProcID with descriptor UniqueID.

Message #

Parameter change request registered for process %1 with descriptor %2.

Fields #

Name	Description
`ProcID` UInt32	—
`UniqueID` UInt32	—
`EventPath` AnsiString	—
`ClassIDSize` UInt32	—
`ClassID` Binary	—
`OptListSize` UInt32	—
`OptList` Binary	—
`IsVendor` Boolean	—

Event ID 50089 — Parameter change request unregistered for process ProcID with descriptor UniqueID.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: NetworkParameterStateEvent
Opcode: ParamChangeUnregister

Description

Parameter change request unregistered for process ProcID with descriptor UniqueID.

Message #

Parameter change request unregistered for process %1 with descriptor %2.

Fields #

Name	Description
`ProcID` UInt32	—
`UniqueID` UInt32	—

Event ID 50090 — Parameter change request notified for process ProcID with descriptor UniqueID.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: NetworkParameterStateEvent
Opcode: ParamChangeNotification

Description

Parameter change request notified for process ProcID with descriptor UniqueID. The status of the operation was StatusCode.

Message #

Parameter change request notified for process %1 with descriptor %2. The status of the operation was %3.

Fields #

Name	Description
`ProcID` UInt32	—
`UniqueID` UInt32	—
`StatusCode` UInt32	—

Event ID 50091 — Parameter request received on interface with LUID InterfaceLUID.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: NetworkParameterStateEvent
Opcode: ParamRequest

Description

Parameter request received on interface with LUID InterfaceLUID. Attempting to acquire the interface context.

Message #

Parameter request received on interface with LUID %1. Attempting to acquire the interface context.

Fields #

Name	Description
`InterfaceLUID` HexInt64	—
`ClassIDSize` UInt32	—
`ClassID` Binary	—
`StandardOptListSize` UInt32	—
`StandardOptList` Binary	—
`VendorOptListSize` UInt32	—
`VendorOptList` Binary	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50091,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 114,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T05:29:24.468880+00:00",
    "event_record_id": 311,
    "correlation": {
      "ActivityID": "016B2C13-AC33-4F64-8DD0-EF124435F040"
    },
    "execution": {
      "process_id": 1944,
      "thread_id": 2972
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceLUID": "0x6008004000000",
    "ClassIDSize": 0,
    "ClassID": "",
    "StandardOptListSize": 1,
    "StandardOptList": "FC",
    "VendorOptListSize": 0,
    "VendorOptList": ""
  },
  "message": ""
}

Event ID 50092 — Parameter request unblocked on interface with LUID InterfaceLUID and index InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: NetworkParameterStateEvent
Opcode: ParamRequestUnblocked

Description

Parameter request unblocked on interface with LUID InterfaceLUID and index InterfaceId.

Message #

Parameter request unblocked on interface with LUID %1 and index %2.

Fields #

Name	Description
`InterfaceLUID` HexInt64	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50092,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 115,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T05:30:52.676651+00:00",
    "event_record_id": 371,
    "correlation": {
      "ActivityID": "016B2C13-AC33-4F64-8DD0-EF124435F040"
    },
    "execution": {
      "process_id": 1944,
      "thread_id": 2972
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceLUID": "0x6008004000000",
    "InterfaceId": 14
  },
  "message": ""
}

Event ID 50093 — Parameter request completed on interface with LUID InterfaceLUID and index InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: NetworkParameterStateEvent
Opcode: ParamRequestComplete

Description

Parameter request completed on interface with LUID InterfaceLUID and index InterfaceId. The status of the operation was StatusCode.

Message #

Parameter request completed on interface with LUID %1 and index %2. The status of the operation was %3.

Fields #

Name	Description
`InterfaceLUID` HexInt64	—
`InterfaceId` UInt32	—
`StatusCode` UInt32	—
`OptDataSize` UInt32	—
`OptData` Binary	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50093,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 116,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T05:30:52.676769+00:00",
    "event_record_id": 374,
    "correlation": {
      "ActivityID": "016B2C13-AC33-4F64-8DD0-EF124435F040"
    },
    "execution": {
      "process_id": 1944,
      "thread_id": 2972
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceLUID": "0x6008004000000",
    "InterfaceId": 14,
    "StatusCode": 0,
    "OptDataSize": 0,
    "OptData": ""
  },
  "message": ""
}

Event ID 50094 — Firewall port DwordVal1 exemption triggered on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: FirewallPortExemptionTriggered

Description

Firewall port DwordVal1 exemption triggered on interface InterfaceId.

Message #

Firewall port %2 exemption triggered on interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—
`DwordVal1` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50094,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 117,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:24:29.781248+00:00",
    "event_record_id": 50,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18,
    "DwordVal1": 68
  },
  "message": ""
}

Event ID 50095 — Firewall port DwordVal1 close triggered on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: FirewallPortCloseTriggered

Description

Firewall port DwordVal1 close triggered on interface InterfaceId.

Message #

Firewall port %2 close triggered on interface %1.

Fields #

Name	Description
`InterfaceId` UInt32	—
`DwordVal1` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50095,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 118,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:26:34.535918+00:00",
    "event_record_id": 91,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceId": 18,
    "DwordVal1": 68
  },
  "message": ""
}

Event ID 50096 — DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER transmissions on interface InterfaceId because the machine is in Connected Standby state...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AbandonDiscovInCSSinceStateless

Description

Message #

DHCP has cancelled IPv4 address acquisition cycle after %1 DISCOVER transmissions on interface %2 because the machine is in Connected Standby state and the interface has the stateless IPv6 address %3.

Fields #

Name	Description
`DwordVal1` UInt32	—
`InterfaceId` UInt32	—
`Address` Binary	—

Event ID 50097 — DHCP has cancelled IPv4 address acquisition cycle after DwordVal1 DISCOVER transmissions on interface InterfaceId because the machine is in Connected Standby state...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: AbandonDiscovInCSSinceStatic

Description

Message #

DHCP has cancelled IPv4 address acquisition cycle after %1 DISCOVER transmissions on interface %2 because the machine is in Connected Standby state and the interface has the static IPv6 address %3.

Fields #

Name	Description
`DwordVal1` UInt32	—
`InterfaceId` UInt32	—
`Address` Binary	—

Event ID 50098 — DHCP will not try regular IPv4 address acquisition on interface InterfaceId since the machine is in Connected Standby state and the interface has the IPv6 a...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: DontStartDiscovInCSSinceV6Plumbed

Description

DHCP will not try regular IPv4 address acquisition on interface InterfaceId since the machine is in Connected Standby state and the interface has the IPv6 address Address.

Message #

DHCP will not try regular IPv4 address acquisition on interface %1 since the machine is in Connected Standby state and the interface has the IPv6 address %2.

Fields #

Name	Description
`InterfaceId` UInt32	—
`Address` Binary	—

Event ID 50099 — DHCP will try regular IPv4 address acquisition on interface InterfaceId even though the machine is in Connected Standby state since the interface has no IPv...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: StartDiscovInCSSinceV6Unplumbed

Description

DHCP will try regular IPv4 address acquisition on interface InterfaceId even though the machine is in Connected Standby state since the interface has no IPv6 address.

Message #

DHCP will try regular IPv4 address acquisition on interface %1 even though the machine is in Connected Standby state since the interface has no IPv6 address.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50100 — DHCP will try regular IPv4 address acquisition on interface InterfaceId due to registry settings even though the machine is in Connected Standby state and t...

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: StartDiscovInCSAtCompulsoryTime

Description

DHCP will try regular IPv4 address acquisition on interface InterfaceId due to registry settings even though the machine is in Connected Standby state and the interface has an IPv6 address.

Message #

DHCP will try regular IPv4 address acquisition on interface %1 due to registry settings even though the machine is in Connected Standby state and the interface has an IPv6 address.

Fields #

Name	Description
`InterfaceId` UInt32	—

Event ID 50101 — The DHCPv4 client received connected standby entry notification.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: NetworkParameterStateEvent
Opcode: NotifyCSEntry

Description

The DHCPv4 client received connected standby entry notification.

Message #

The DHCPv4 client received connected standby entry notification.

Event ID 50102 — The DHCPv4 client received connected standby exit notification.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: NetworkParameterStateEvent
Opcode: NotifyCSExit

Description

The DHCPv4 client received connected standby exit notification.

Message #

The DHCPv4 client received connected standby exit notification.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50102,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 120,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:05:03.977367+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 1988
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 50103 — DHCPv4 client registered for shutdown notification

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceShutdown

Description

DHCPv4 client registered for shutdown notification.

Message #

DHCPv4 client registered for shutdown notification

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50103,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 129,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-06T06:25:39.972458+00:00",
    "event_record_id": 1674,
    "correlation": {},
    "execution": {
      "process_id": 2372,
      "thread_id": 2408
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50104 — DHCPv4 client received shutdown notification

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceShutdown

Description

DHCPv4 client received shutdown notification.

Message #

DHCPv4 client received shutdown notification

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50104,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 129,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:31:36.636619+00:00",
    "event_record_id": 1852,
    "correlation": {},
    "execution": {
      "process_id": 2232,
      "thread_id": 2236
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50105 — DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceShutdown

Description

DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT.

Message #

DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50105,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 129,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:31:36.639339+00:00",
    "event_record_id": 1853,
    "correlation": {},
    "execution": {
      "process_id": 2232,
      "thread_id": 2328
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50106 — DHCPv4 is waiting on DHCPv6 service to stop

Provider: Microsoft-Windows-Dhcp-Client
Channel: System
Level: Informational
Task: ServiceStateEvent
Opcode: ServiceShutdown

Description

DHCPv4 is waiting on DHCPv6 service to stop.

Message #

DHCPv4 is waiting on DHCPv6 service to stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 50106,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 129,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:31:37.009976+00:00",
    "event_record_id": 1857,
    "correlation": {},
    "execution": {
      "process_id": 2232,
      "thread_id": 2328
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50107 — Firewall port exemption is in progress but incomplete.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ServiceStateEvent
Opcode: FirewallExemptionDelayed

Description

Firewall port exemption is in progress but incomplete. Error code is DwordVal.

Message #

Firewall port exemption is in progress but incomplete. Error code is %1.

Fields #

Name	Description
`DwordVal` UInt32	—

Event ID 60000 — PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackAckConfirm

Description

PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId. Confirmed Address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Ack): Address confirmed for the interface %2. Confirmed Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60001 — PERFTRACK (DORA): Offer is accepted on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackAckDORA

Description

PERFTRACK (DORA): Offer is accepted on the interface InterfaceId. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (DORA): Offer is accepted on the interface %2. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60002 — PERFTRACK: Gateway is reachable on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackGatewayReachable

Description

PERFTRACK: Gateway is reachable on the interface InterfaceId.

Message #

PERFTRACK: Gateway is reachable on the interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60003 — PERFTRACK: DHCP is not enabled on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackStatic

Description

PERFTRACK: DHCP is not enabled on the interface InterfaceId.

Message #

PERFTRACK: DHCP is not enabled on the interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60003,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 61,
    "keywords": 9223653511831486464,
    "time_created": "2026-03-13T20:18:54.399323+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 60004 — PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since no response is received for request.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackFallbackAddressSet

Description

PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since no response is received for request. Status code is StatusCode.

Message #

PERFTRACK: Setting up Fallback configuration on the interface %2 since no response is received for request. Status code is %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 60005 — PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleRequestAck

Description

PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT. Confirmed address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Ack): Address confirmed for the interface %2 after toggling the broadcast bit in INIT-REBOOT. Confirmed address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60006 — PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleDORAAck

Description

PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface %2 after toggling the broadcast bit in INIT-REBOOT. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60007 — PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleInitDORA

Description

PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (Init-Dora): Offer is accepted on the interface %2 after toggling the broadcast bit in INIT. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60010 — PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackAckConfirm

Description

PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId. Confirmed Address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Ack): Address confirmed for the interface %2. Confirmed Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60011 — PERFTRACK (DORA): Offer is accepted on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackAckDORA

Description

PERFTRACK (DORA): Offer is accepted on the interface InterfaceId. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (DORA): Offer is accepted on the interface %2. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60012 — PERFTRACK: Gateway is reachable on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackGatewayReachable

Description

PERFTRACK: Gateway is reachable on the interface InterfaceId.

Message #

PERFTRACK: Gateway is reachable on the interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60013 — PERFTRACK: DHCP is not enabled on the interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackStatic

Description

PERFTRACK: DHCP is not enabled on the interface InterfaceId.

Message #

PERFTRACK: DHCP is not enabled on the interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60013,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 61,
    "keywords": 9223653511831486464,
    "time_created": "2026-03-13T20:18:54.399322+00:00",
    "event_record_id": 18,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 60014 — PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since no response is received for request.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackFallbackAddressSet

Description

PERFTRACK: Setting up Fallback configuration on the interface InterfaceId since no response is received for request. Status code is StatusCode.

Message #

PERFTRACK: Setting up Fallback configuration on the interface %2 since no response is received for request. Status code is %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`StatusCode` UInt32	—

Event ID 60015 — PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleRequestAck

Description

PERFTRACK (Request-Ack): Address confirmed for the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT. Confirmed address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Ack): Address confirmed for the interface %2 after toggling the broadcast bit in INIT-REBOOT. Confirmed address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60016 — PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleDORAAck

Description

PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT-REBOOT. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (Request-Nack-Dora): Offer is accepted on the interface %2 after toggling the broadcast bit in INIT-REBOOT. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60017 — PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackToggleInitDORA

Description

PERFTRACK (Init-Dora): Offer is accepted on the interface InterfaceId after toggling the broadcast bit in INIT. Offered Address is Address1. Server address is Address2.

Message #

PERFTRACK (Init-Dora): Offer is accepted on the interface %2 after toggling the broadcast bit in INIT. Offered Address is %3. Server address is %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—
`Address1` UInt32	—
`Address2` UInt32	—

Event ID 60018 — PERFTRACK (DHCPv4): Media Connect on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: MediaStateEvent
Opcode: PerfTrackMediaConnect

Description

PERFTRACK (DHCPv4): Media Connect on interface InterfaceId.

Message #

PERFTRACK (DHCPv4): Media Connect on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60018,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 14,
    "keywords": 9223653511831486464,
    "time_created": "2026-03-13T20:18:54.399313+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 60019 — PERFTRACK (DHCPv4): End of Media Connect on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: MediaStateEvent
Opcode: PerfTrackMediaConnectEnd

Description

PERFTRACK (DHCPv4): End of Media Connect on interface InterfaceId.

Message #

PERFTRACK (DHCPv4): End of Media Connect on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60019,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 15,
    "keywords": 9223653511831486464,
    "time_created": "2026-03-13T20:18:51.250436+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 1772,
      "thread_id": 8220
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "InterfaceId": 4
  },
  "message": ""
}

Event ID 60020 — PERFTRACK (Media Reconnect): Media reconnect notification was received on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: MediaStateEvent
Opcode: PerfTrackMediaReconnect

Description

PERFTRACK (Media Reconnect): Media reconnect notification was received on interface InterfaceId.

Message #

PERFTRACK (Media Reconnect): Media reconnect notification was received on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60021 — PERFTRACK (Discover-DelayedResponse): Offer/Ack is not received for first discover/request on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackDiscoverNetworkLatency

Description

PERFTRACK (Discover-DelayedResponse): Offer/Ack is not received for first discover/request on interface InterfaceId.

Message #

PERFTRACK (Discover-DelayedResponse): Offer/Ack is not received for first discover/request on interface %2.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60022 — PERFTRACK (Discover-Timeout): No response is received for all 8 discovers on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: ProtocolStateEvent
Opcode: PerfTrackDiscoverTimeout

Description

PERFTRACK (Discover-Timeout): No response is received for all 8 discovers on interface InterfaceId. Fallback address is not set.

Message #

PERFTRACK (Discover-Timeout): No response is received for all 8 discovers on interface %2. Fallback address is not set.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60022,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 96,
    "keywords": 9223653511831486464,
    "time_created": "2026-03-13T20:26:34.536149+00:00",
    "event_record_id": 93,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 3428
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "B009EF7D-3A19-47A7-AEE7-9535ABA6A145",
    "InterfaceId": 18
  },
  "message": ""
}

Event ID 60023 — PERFTRACK (Request-DelayedAck): Ack is not received for first request on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackRequestNetworkLatency

Description

PERFTRACK (Request-DelayedAck): Ack is not received for first request on interface InterfaceId.

Message #

PERFTRACK (Request-DelayedAck): Ack is not received for first request on interface %2.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60024 — PERFTRACK (Request-NoResponse): There is no response for INIT-REBOOT Request on interface InterfaceId.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: ProtocolStateEvent
Opcode: PerfTrackRequestNoResponse

Description

PERFTRACK (Request-NoResponse): There is no response for INIT-REBOOT Request on interface InterfaceId. Gateway is not reachable and fallback address is not set.

Message #

PERFTRACK (Request-NoResponse): There is no response for INIT-REBOOT Request on interface %2. Gateway is not reachable and fallback address is not set.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`InterfaceId` UInt32	—

Event ID 60025 — PERFTRACK: Fallback address Address is plumbed on interface InterfaceId after DHCP did not get response for discover.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: PerfTrackFallbackAfterDiscover

Description

PERFTRACK: Fallback address Address is plumbed on interface InterfaceId after DHCP did not get response for discover.

Message #

PERFTRACK: Fallback address %2 is plumbed on interface %3 after DHCP did not get response for discover.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Address` UInt32	—
`InterfaceId` UInt32	—

Event ID 60026 — Entered ProcessDhcpRequestForever.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: ProcessDHCPRequestForeverEntered

Description

Entered ProcessDhcpRequestForever.

Message #

Entered ProcessDhcpRequestForever.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60026,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 122,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:05:04.005177+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 1964
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 60027 — ProcessDhcpRequestForever Timed out.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Level: Informational
Task: AddressConfigurationStateEvent
Opcode: ProcessDHCPRequestForeverTimedout

Description

ProcessDhcpRequestForever Timed out.

Message #

ProcessDhcpRequestForever Timed out.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 60027,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 123,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:05:04.014289+00:00",
    "event_record_id": 18,
    "correlation": {},
    "execution": {
      "process_id": 1868,
      "thread_id": 1964
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 60028 — CreateRenewalSignalHandle failed with error StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: CreateRenewalSignalHandleFailed

Description

CreateRenewalSignalHandle failed with error StatusCode.

Message #

CreateRenewalSignalHandle failed with error %1.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 60029 — DeleteRenewTimer failed with error StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: DeleteRenewTimerFailed

Description

DeleteRenewTimer failed with error StatusCode.

Message #

DeleteRenewTimer failed with error %1.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 60030 — ResetRenewalSignalHandle failed with error StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: ResetRenewalSignalHandleFailed

Description

ResetRenewalSignalHandle failed with error StatusCode.

Message #

ResetRenewalSignalHandle failed with error %1.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 60031 — CreateRenewTimer failed with error StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: CreateRenewTimerFailed

Description

CreateRenewTimer failed with error StatusCode.

Message #

CreateRenewTimer failed with error %1.

Fields #

Name	Description
`StatusCode` UInt32	—

Event ID 60032 — ProcessDhcpRequestForever failed with error StatusCode.

Provider: Microsoft-Windows-Dhcp-Client
Channel: Operational
Task: AddressConfigurationStateEvent
Opcode: ProcessDHCPRequestForeverFailed

Description

ProcessDhcpRequestForever failed with error StatusCode.

Message #

ProcessDhcpRequestForever failed with error %1.

Fields #

Name	Description
`StatusCode` UInt32	—