4

Possible Duplicate:
Find all past desktop IP addresses

I have a bunch of windows computers and due to a monitoring need I need to check their (static) ip address history.

When the user changes the ip address is there anywhere the ip address gets saved, logged or cached in any form at all? (I don't even need times, the simple ip address would do)

Community
  • 1
Akshat
  • 161
  • 1
    If the IP addresses are being changed, wouldn't they be considered Dynamic and not Static? – Django Reinhardt Dec 15 '12 at 17:52
  • We have static ip addresses assigned to certain machines, but users seem to change them to use the network maliciously, its a bit difficult to get the mac address from the ip, but that a whole different question – Akshat Dec 15 '12 at 17:55
  • im looking at static addresses not dynamic ones – Akshat Dec 15 '12 at 17:57
  • 1
    xp?vista? win7? group policy? are they local admins? – Logman Dec 15 '12 at 18:09
  • They are local admins, there isn't a group policy or domain controller being used with Win XP (for compatibility) and Win 7 computers – Akshat Dec 15 '12 at 18:14
  • @Akshat The other question is also regarding the past history of Static IP addresses, and the answers (as far as I know) still apply fully in newer versions of Windows. Regardless, it's the same question, and other (newer) answers can/should be added to it. – Ƭᴇcʜιᴇ007 Dec 15 '12 at 18:18

2 Answers2

2

You could try the system event log. Filter for source 'iphlpsvc' and Event Id 4200.

EDIT: Turns out this only works on Server (2008R2), even though the 'IP Helper' service is running on Windows 7 as well, it seems it doesn't write anything to the event log.

I had 5 VMs open and picked the wrong one for the test, sorry.

I couldn't find anything in the service config to turn logging on, but that doesn't mean that's not possible, but you will not get past events.

Peter Hahndorf
  • 13,710
  • Didn't work for me, but Searching the Event log for events produced by such services (and perhaps your network adapter's drivers) are probably the best bet. You should add this answer to the linked duplicate. :) – Ƭᴇcʜιᴇ007 Dec 15 '12 at 18:23
1

When using TCP/IP on an Ethernet network the ARP traffic reveals physical address (MAC) to IP address mappings. This is done with various announcements and queries the results of which are often cached. A router will usually provide an easy way to list this information. In Windows for IP addresses contacted recently (so they are in the ARP cache) you can use ARP -a to list the information. A Windows AD domain controller is an example of such a machine.

Retrieving this information from a machine/router you control and logging it will even let you spot suspicious new MAC addresses should somebody start changing that as well.

Brian
  • 8,944