As per Microsoft: "This problem can occur if the ICW had been previously run and "Modem or terminal adapter (example: internal ISDN cards)" had been selected as the connection type, and Windows 2000 DNS had been stopped and disabled". See ME282924 to fix this problem.
If a DHCP Server service is not running on a domain controller, the service behaves exactly as it does on a Windows 2000-based server. If the DHCP Server service is running on a DC, the service logs the 1002 Event ID in the System Event log and behaves exactly as it does on a Windows 2000-based server.
As per ME298490, this behavior can occur because the DHCP server service is not bound to a statically-configured Transmission Control Protocol/Internet Protocol (TCP/IP) adapter, which is usually the internal adapter.
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.