Event ID 1031 — [EVENT_SERVER_CALLOUT_UNHANDLED_EXCEPTION] The installed server callout .dll file has caused an exception.

Provider: Microsoft-Windows-DHCP-Server
Channel: Operational

Description

The installed server callout .dll file has caused an exception. The exception was.

Message #

The installed server callout .dll file has caused an exception. The exception was: 
%1.  The server has ignored this exception. All further exceptions will be ignored.

Detection Patterns #

Persistence: DLL

DHCP-Server Event ID 1031: [EVENT_SERVER_CALLOUT_UNHANDLED_EXCEPTION] The installed server callout .dll file has caused an exception.OREvent ID 1032: [EVENT_SERVER_CALLOUT_LOAD_EXCEPTION] The installed server callout .dll file has caused an exception. The .dll file couldn't be loaded.OREvent ID 1034: [EVENT_SERVER_READ_ONLY_GROUP_ERROR] The DHCP service has failed to load one or more callout DLLs.

1 rule

Sigma

DHCP Server Error Failed Loading the CallOut DLL (source)

Dimitrios Slamaris, @atc_project (fix)

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-server-events