| Event Id | 14188 |
| Source | Microsoft ISA Server |
| Description | ISA Server detected a change in the IP routing table of the computer |
| Event Information | According to Microsoft: Cause: This event message is logged even when the DHCP address that is obtained from the DHCP server is the same as the Internet Protocol (IP) address for the interface that was previously assigned by the DHCP server. Resolution: If the Routing and Remote Access Service (RRAS) is installed as a dial-up or VPN server on the ISA Server, RRAS client connection events will trigger this alert. RRAS changes the Windows routing table to accommodate each client. In this scenario, Microsoft recommends that you leave the "Network Configuration Changed" alert disabled (the default). To turn on the Network Configuration Changed alert in ISA Server and to configure the alert to write an event in the application event log when it is triggered: 1. Start ISA Server Microsoft Management Console (MMC). 2. Expand Servers and Arrays, expand the server, and then expand Monitoring Configuration. 3. Click Alerts, and then double click Network Configuration Changed. 4. On the General tab, click to select the Enable check box. 5. Click OK. By default, when you turn on this alert, an event is logged to the application event log on the server. You can configure other actions as appropriate before you click OK. NOTE: To turn off the Network Configuration Changed alert, click to clear the Enable check box. If an event ID 14188 message is logged in the application event log, view the DHCP lease time to see if it coincides with the time of the alert. To do so: 1. Open a command prompt on the server that is running ISA Server. 2. Type ipconfig /all. 3. Review the Lease Obtained time for all DHCP-enabled adapters. Compare the Lease Obtained time to the time that the event ID 14188 message was logged. If these times are the same, you can safely ignore this event ID message. This information from newsgroup may help: ---------------------------------------------------------------- |
| Reference Links | Event ID 14188 Message Occurs If the Network Configuration Changed Alert Is Turned On |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.