⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 1020 - DHCP-Server

DHCP-Server - 1020


Description »
Scope,, is 86 percent full with only 6 IP addresses remaining.
Data formatted as » None

This event appears on Windows 2008 DHCP servers when a scope is becoming full. It will appear from source DHCPServer on Windows 2000 or Windows 2003.

Unfortunately, there is little you can do to resolve this immediatetely. You can go looking for DHCP leases which might not be needed anymore - but ultimately, you probably have a capacity issue to look at. Perhaps you created a scope with 200 addresses, thinking that would be enough for your small office of 25 people - then, a few years later, with 150 people (plus printers, servers, switches, etc) you have started to run out of addresses. Perhaps you have some DHCP reservations which aren't needed anymore (eg network printer which no longer exists). Perhaps you have a stupidly long lease duration (eg an eight day lease for lots of laptops which might only show up one or two days a week). If that's the case, you can look at shortening your lease duration - but if everyone is in the office Mon-Fri, 9-5, you're not going to see much benefit from shortening the lease, since all your devices will want addresses at the same time.

Stepping it up another level, you can recreate your DHCP scope with a wider range of addresses. Perhaps your scope is assigning -, with addresses between .20 and .49 going unused. If that's the case, you can recreate the scope starting at .25, to give yourself an extra 25 IP addresses. Ultimately, if you will want to look at your LAN design and maybe split your devices across several subnets/VLANs (and hopefully start looking at how IPv6 might help you out).

If you can honestly say that you have a scope which is almost or completely full, and the usage will never grow, you can adjust the threshold for these events. The registry key DhcpAlertPercentage can be set to the percentage of scope usage at which you would like the warning to be logged. For example, if you only want to have the warning logged when 1% of the scope is available, you would set this value to (decimal) 99.