| Event Id | 1028 |
| Source | Microsoft-Windows-DHCP-Server |
| Description | The DHCP service failed to initialize the audit log. The following error occurred:1% |
| Event Information | According to Microsoft : Cause : This event is logged when the DHCP service failed to initialize the audit log. Resolution : Give the DHCP service account permissions to audit log files and folders The event log cannot function correctly unless proper file permissions are assigned to the log files. You might need to do the following: a)Assign permissions to the audit log files so that the service can write to them. b)Assign user write permissions to the folder where the audit log file is created. Note : To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority. To change permissions on files and folders: 1.At the DHCP server, clickStart, point to All programs, point toAccessories, and then clickWindows Explorer.2.Navigate the directory tree to %windir%\System32\Dhcp, right-click the folder, clickProperties, and then click theSecurity tab. 3.Complete one of the following as needed: a)To set permissions for a group or user that does not appear in theGroup or user names box, clickAdd, type the name of the group or user, and then clickOK. b)To change or remove permissions from an existing group or user, click the name of the group or user. c)To allow or deny a permission, in thePermissions for User or Group box, select the Allow or Deny check box. d)To remove the group or user from theGroup or user names box, clickRemove. Verify : To verify that the DHCP audit log is functioning correctly: 1)At the DHCP server, click Start, type Windows Explorer inStart Search, and then press ENTER. 2.Navigate the Windows Explorer tree to %windir%\System32\Dhcp. 3.View and record the most recent DHCP log file date stamps. They should be recent. Repeat this process at regular intervals and note whether new events are being logged |
| Reference Links | Event ID 1028 from Source Microsoft-Windows-DHCP-Server |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.