Event ID 4199 and Windows client can't get an IP address from the DHCP server

Windows client can't get an IP address from the Dynamic Host Configuration Protocol (DHCP) server, and Event ID 4199 is logged as follows:

Log Name: System  
Source: Tcpip  
Date: <Date>  
Event ID: 4199  
Task Category: None  
Level: Error  
Keywords: Classic  
User: N/A  
Computer: <Computer Name>  

Description:  
The system detected an address conflict for IP address 0.0.0.0. with the system having network hardware address <Network Hardware Address>. Network operations on this system may be disrupted as a result.  

When you check the DHCP server audit logs (%windir%\System32\dhcp\DHCP.log*), you find many BAD_ADDRESS entries. Here's an example (%windir%\System32\dhcp\DhcpSrvLog-Fri.log):

11,11/22/19,09:30:39,Renew,10.2.29.108,<Computer Name>.contoso.com,<MAC Address>,,230319146,0,,,,0x4D53465420352E30,MSFT 5.0,,,0x010C766C616E2D323032382D6871,0   
13,11/22/19,09:30:43,Conflict,10.2.29.108,BAD_ADDRESS,,,0,6,,,,,,,,,0  

ARP probe is detected as a duplicate IP address

The cause might be related to a Layer 3 switch or router security feature called "IP Device Tracking." If the switch or router sends out an address resolution protocol (ARP) probe for the client while the Windows client is in the duplicate address detection (DAD) phase, the client detects the probe as a duplicate IP address and declines the IP address offered by the DHCP server.

Note

Windows DHCP clients that obtain an IP address use a gratuitous ARP request to perform a client-based conflict detection before completing configuration and using the server-offered IP address.

Deactivate the IP Device Tracking feature or delay sending ARP probe requests

To resolve this issue, deactivate the IP Device Tracking feature on the Layer 3 switch or router, or delay sending ARP probe requests.

You might also disable the duplicate address detection functionality on the Windows client network interface by using the following cmdlet:

Set-NetIPInterface -InterfaceAlias "Ethernet" -AddressFamily IPv4 -DadTransmits 0 

Important

This action should only be done in well-managed environments, as you risk having duplicate IP addresses on the network without any notifications or warnings from Windows.

Cisco also recognizes this issue and provides the solution in Troubleshoot Duplicate IP Address 0.0.0.0 Error Messages.

Third-party information and solution disclaimer

The information and the solution in this document represents the current view of Microsoft Corporation on these issues as of the date of publication. This solution is available through Microsoft or through a third-party provider. Microsoft does not specifically recommend any third-party provider or third-party solution that this article might describe. There might also be other third-party providers or third-party solutions that this article does not describe. Because Microsoft must respond to changing market conditions, this information should not be interpreted to be a commitment by Microsoft. Microsoft cannot guarantee or endorse the accuracy of any information or of any solution that is presented by Microsoft or by any mentioned third-party provider.

Microsoft makes no warranties and excludes all representations, warranties, and conditions whether express, implied, or statutory. These conditions include but are not limited to representations, warranties, or conditions of title, non-infringement, satisfactory condition, merchantability, and fitness for a particular purpose, regarding any service, solution, product, or any other materials or information. In no event will Microsoft be liable for any third-party solution that this article mentions.