question

JC34209324-2760 avatar image
0 Votes"
JC34209324-2760 asked GaryReynolds commented

Enabling 002 Microsoft Release DHCP Lease On Shutdown Option

Hello, is there a way to validate that the Microsoft Advanced Option 002 Release DHCP Lease On Shutdown Option is working when a workstation is rebooted or shut down?

I've enabled the option already and it has a value of "0x1". Is this correct or does the value need to be "0x00000001" as specified in the MS doc below? I confirmed the option was set in Server Options and is also present on all of the subnets' Scope Options. I've tested by rebooting a workstation (twice) that obtained its lease from the DHCP Server. I noticed that it kept the same IP Address after being rebooted, but the lease timestamp updated after each reboot. During this process, how do I know the workstation sent the DHCPRELEASE message?

I used this doc for reference - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dhcpe/4cde5ceb-4fc1-4f9a-82e9-13f6b38d930c


Thank you in advance for your input.

windows-serverwindows-dhcp-dns
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

GaryReynolds avatar image
0 Votes"
GaryReynolds answered GaryReynolds commented

Hi @JC34209324-2760

The fact that the workstation has the same IP after a reboot doesn't necessarily mean that the IP address is not being released as the server could be issuing the same IP address.

The easiest option to confirm that the workstation are sending the release is to enable the auditing on the DHCP server. This should contain the details of the requests that are being received by the server. The other option is to do a network capture of the workstation startup and shutdown process and monitor the DHCP traffic that is sent by the workstation. You will need to do this with network hub or a port mirror to to capture the traffic, or do the capture on the DHCP server, as most of the DHCP traffic is unicast.

Gary.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @GaryReynolds-8098 , thank you for your reply.

I do have DHCP auditing enabled and when I looked at the Dhcp-SrvLog-Sun and Dhcp-SrvLog-Mon for this week on 10/24 and 10/25, I don't see an explicit "DHCPRELEASE" message from the client.

I do see the logged events below, but not sure if the Release event is the same as "DHCPRELEASE".


12,10/25/21,00:05:43,Release,IPADDRESS,HOSTNAME,MACADRESS
32,10/25/21,00:05:43,DNS Update Successful,IPADDRESS,HOSTNAME
30,10/25/21,00:05:43,DNS Update Request,IPADDRESS,HOSTNAME
10,10/25/21,00:05:43,Assign,IPADDRESS,HOSTNAME,MACADRESS

0 Votes 0 ·

Hi

I would say that the Release is the DHCPRELEASE but the only way you can confirm that is with a network trace. Another option would be to switch the machine, let it get an IP address leave it on for 10-15 mins, then switch it off and while it's switched off, check the status of the IP address in the DHCP pool and see if it's still assigned.

Gary.

0 Votes 0 ·