Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1002 Source: Dhcp

Source
Level
Description
The IP address lease 192.168.0.2 for the Network Card with network address 0080C6FACA52 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
Comments
 
In my case, releasing and renewing the IP address configuration fixed the problem.
In my case, it was an IP Address that has been (mistakenly) kept by the OS and is on a totally different subnet than the present network. The solution was to open command prompt and type ipconfig /release, then type ipconfig /renew.
In my case, restarting the router solved the problem.
As per Microsoft: "This could be caused by a scope change. For example, when a roaming laptop moves from one network to another, its IP address lease might need renewal. When the DHCP Client service tries to renew the address, that request might go to a different server that will not extend the lease either because it does not know about this address lease or because it has already issued the address lease to another client". See MSW2KDB for additional information on this event.
The client computer did not receive an IP address from the DHCP server. The cause was a “BAD ADDRESS” entry in the DHCP server leases for the IP address reserved for that computer. After deleting this entry, the correct IP address was given.


See ME830525 for details on this problem.
Manually configuring the network IP addresses appears to cure this in the majority of cases. An explanation can be found if you follow the link to Computech.
I have had this error on a user’s notebook. The user was from another site. After seeing this error, the port the user was attached to on the Cisco switch was disabled. After investigation, it turned out the user had incorrect DNS settings and had them specified rather than using DCHP to discover the settings. Reconfiguring these settings resolved all the problems.
In my case, I use a laptop between my office, customers and home. It seems that my last address is still registred somewhere even if I change my domain connection. I use multi-network manager to switch from one domain to another before logging in. This utility reboots my laptop after I choose a domain.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...