How do I enable DHCP server logging?

A. To enable enhanced DHCP logging, perform the following steps:

Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
Right-click the DHCP server, and select Properties from the context menu.
Select the General tab.
Select the "Enable DHCP audit logging" check box.

Windows 2000 will now create a DHCP log file in the %systemroot%\system32\dhcp directory for each day using a DhcpSrvLog.XXX file format.

Common audit codes that might appear in the log include

00—The log was started.
01—The log was stopped.
02—The log was temporarily paused due to low disk space.
10—A new IP address was leased to a client.
11—A lease was renewed by a client.
12—A lease was released by a client.
13—An IP address was found to be in use on the network.
14—A lease request could not be satisfied because the scope's address pool was exhausted.
15—A lease was denied.
16—A lease was deleted.
17—A lease was expired.
20—A BOOTP address was leased to a client.
21—A dynamic BOOTP address was leased to a client.
22—A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
23—A BOOTP IP address was deleted after verifying that it wasn't in use.

The DHCP Server uses codes above 50 for Rogue Server Detection information.