detection.wiki

Microsoft-Windows-Dhcp-Client › Event 1002

Event ID 1002 — The IP address lease Address1 for the Network Card with network address HWAddress has been denied by the DHCP server Address2 (The DHCP Server sent a DHCPNACK message).

Provider
Microsoft-Windows-Dhcp-Client
Channel
Admin
Level
Error
Task
AddressConfigurationStateEvent
Opcode
IpLeaseDenied

Description

The IP address lease Address1 for the Network Card with network address HWAddress has been denied by the DHCP server Address2 (The DHCP Server sent a DHCPNACK message).

Message #

The IP address lease %1 for the Network Card with network address %3 has been denied by the DHCP server %4 (The DHCP Server sent a DHCPNACK message).

Fields #

NameDescription
Address1 UInt32—
HWLength UInt32—
HWAddress Binary—
Address2 UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dhcp-Client",
    "guid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED",
    "event_source_name": "",
    "event_id": 1002,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 76,
    "keywords": 4611686018427387905,
    "time_created": "2023-10-25T22:48:31.191302+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 2312
    },
    "channel": "Microsoft-Windows-Dhcp-Client/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Address1": 2182457536,
    "HWLength": 6,
    "HWAddress": "000C29B19818",
    "Address2": 0
  },
  "message": ""
}

References #