Windows DHCP Event Monitor Reference Guide

Windows DHCP Event Monitor

Monitors Windows DHCP servers. Checks usage levels of lease blocks and verifies that devices are listed in AD.


The Windows DHCP Event Monitor checks your DHCP server and warns based on percentages of scope usage and new lease grants. It can also alert you about any devices that have received a DHCP lease but are not listed in Active Directory. This event monitor supports DHCP running on Windows Server 2008 and later. To allow this event monitor to connect, you may need to perform the following steps on the FrameFlow server:

1. Open PowerShell and enter "Add-WindowsFeature RSAT-DHCP".

2. When that completes run "Import-Module DhcpServer".

Windows Firewall rule "DHCP Server Management" needs to be enabled. It is enabled by default.

Use Cases

  • Getting alerts based on address scope utilization
  • Receiving alerts on new leased addresses

Monitoring Options

This event monitor provides the following options:

Alert with [Info/Warning/Error/Critical] if the device cannot be contacted

Use this option to alert if the event monitor cannot connect to the network device.

Alert with [Info/Warning/Error/Critical] if the DHCP service is not running

Use this option to get alerts if the event monitor was able to connect to the device but the DHCP service was not running.

Alert based on the percentage of leased addresses being used in any scope

With this option enabled, the event monitor will check each DHCP scope and alert you based on the percentage of assigned IP addresses.

Alert with [Info/Warning/Error/Critical] if a new lease is granted

Use this option to get alerts whenever a new lease is granted.

Alert with [Info/Warning/Error/Critical] if a lease is granted but the device is not found in Active Directory

With this option enabled the event monitor will detect newly granted leases and then see if there is a corresponding device in Active Directory. It will alert you if there is no corresponding device.

Enter the distinguished name for the Active Directory search

Enter the distinguished name for the base of the Active Directory search. For example, if you wish to monitor users and computers in the frameflow.local domain, you would enter "DC=frameflow,DC=local".

Authentication and Security

The account used to monitor this device must be a member of Distributed COM Users group.


Data Points

This event monitor generates the following data points:

Data Point Description
Available IP Addresses % The percentage of IP addresses that are available.
Available IP Addresses The number of available IP addresses.
In Use IP Addresses % The percentage of IP addresses that are in use.
In Use IP Addresses The number of IP addresses that are in use.

Sample Output


To view the tutorial for this event monitor, click here.

Back to Library


There are no user-contributed comments for this page. Be the first to submit a comment!

Add a comment