Microsoft Windows DHCP Server Event ID 73 74 sandwich

oQcS3JJ2xdjHwF67 21 Reputation points
2021-12-14T17:48:40.12+00:00

Hello,

Recently, a DHCP scope was accidentally deactivated and caused problems. During my investigation into what happened, I came across a curious pattern in the logs and I'm hoping someone could explain what is happening and what happened.

In the screenshots below, you see this pattern of DHCPv4.ScopeDeActivated (eventID 74), DHCPv4.ReservationDeleted (eventID 107), DHCPv4.ReservationConfigured (eventID 106), DHCPv4.ScopeActivated ​(eventID 73) sandwiches taking place all in one second. Is this healthy and normal? Any idea what's triggering these batch events?

157561-screen-shot-2021-12-14-at-92413-am.png

157582-screen-shot-2021-12-14-at-93136-am.png

Then, over here, you've got a deactivation (eventID 74), followed by a handful of DHCPv4.ReservationConfigured (eventID 106), but the scope doesn't get reactivated (73):

157563-screen-shot-2021-12-14-at-94611-am.png

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,470 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,170 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,023 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,371 Reputation points
    2021-12-21T16:00:38.187+00:00

    Hi @oQcS3JJ2xdjHwF67

    These event Id is only informational and can be safely ignored. It does not indicate an error. In the case of load balance mode, the servers will hash the MAC address of a DHCP client to establish which of them must respond. In hot standby mode, only the active server responds. In both cases, the DHCP server which does not respond to the client logs this message in the audit log.

    If you still face the issue, you can try troubleshooting from here.
    Troubleshoot problems on the DHCP server
    https://github.com/MicrosoftDocs/windowsserverdocs/blob/master/WindowsServerDocs/troubleshoot/troubleshoot-problems-on-dhcp-server.md

    Hope this resolves your Query!!

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments