How can I enable auditing on my Windows NT 4.0­hosted DHCP servers? Where are the audit logs stored?

NT 4.0 Service Pack 2 (SP2) includes the DHCP Logging feature, which creates a text log file of all DHCP server activity. To enable auditing for the DHCP service, open DHCP Manager, select the DHCP server on which you want to enable auditing, click Properties on the Server menu, and select the Enable DHCP Logging check box.

You must stop and restart the DHCP service after you enable or disable DHCP Logging. The DHCP log data is stored in the %windir%\system32 \dhcp\dhcpsrv.log file. Enabling DHCP logging will, for example, let you trace back to media access control (MAC) addresses from an IP address.