Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1003 Source: DHCP

Source
Level
Description
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address <MAC address>. The following error occurred:
<error description>. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server."
Comments
 
If the DHCP server works properly then this generally means a network or connectivity problem. Try to isolate the physical equipment that connects the workstation in question to the DHCP server.

Reported errors:
- The semaphore timeout period has expired.
- An operation was attempted on something that is not a socket.

As per Microsoft, these events may be recorded on ISA server that is using DHCP to obtain an address for the external network card. The suggested resolution is to uUse the System Policy Editor inside the ISA 2006 Management Console to enable DHCP from External networks.

These settings apply to the ISA server as a DHCP client only. All rules governing DHCP service TO clients should be configured via normal firewall policy rules.

1) Open the ISA Server Management console (msisa.msc)
2) Expand the ISA server object, right-click on Firewall Policy, and select Edit System Policy.
3) Under Network Services, select DHCP. There are two configuration tabs for DHCP: General and From.
4) On the General tab, check Enable to allow access between trusted DHCP servers and the ISA server. This option is enabled by default.
5) On the From tab, click the Add button.
6) Expand Networks, select External and then click the Add button.
7) Click Close and OK to finish editing System Policy rules.
8) Click Apply to save changes and update the configuration.
We switched a Domain Controller in a remote office. One of the workstations was taking forever to see the network, and was not running GP logon scripts, because it could not see the network. The culprit was the DNS settings on the workstation’s NIC. It was set to the IP address of the old DC. When we set it to automatically find the DNS Server and rebooted the system, the workstation worked normally again.
If you are also receiving EventID 11197 from source Dnsapi, look at your zone files, forward and reverse lookup and make sure that there is only one entry for reverse IP and only one forward name lookup. Also, check the security of these entries to make sure the user can update them.
I experienced this network wide and found that the Windows 2003 server was reporting a DHCPserver warning with event ID 1056. After following the instructions to resolve that error, this problem subsided.
I have seen this warning on laptops that have not been connected to the network for a while. The first time they boot while back on the network, this warning is logged together with DHCP event 1006. It is repaired automatically so the warning can be ignored.


As per Microsoft: "This could be caused by network connectivity issues, a DHCP server or relay malfunction, firewall issues, or a malfunction of your computer's network interface card or driver". See MSW2KDB for details.
If youre having the issue with WinXP hosts take a look at ME313896.
See the following articles for information on how to troubleshoot this problem: ME325919, ME255836, ME244268, ME244978, ME154882 and ME173396.
I have a Belkin54g Wireless DSL Router and corresponding wireless network-cards in my home network (Win2k SP4, WinXP Pro SP1). The event occurred only for non-administrator users. No connection to the network could be established, however, the network was visible. Turning off the DHCP function on the router and manually assigning IP-addresses solved the problem. (Additionally, the initial connection to the internet through the router is now much faster.
In my case two clients with automatic DHCP were giving the same error but with no apparent problems with the network. With "flushdns" and "registerdns" using "ipconfig" the problem seems to be fixed. In addition, the DHCP server gave error id 30022 for IPBOOTP which ostensibly shows hardware reading problems on the nic which serves the dhcp. However the above solution solved this one as well.
On my Dell Latitude 400 laptop connected to a Cisco 2924 switch, event 1003 DHCP occurs after a system restart. This is a new clean installtion of XPpro including SP1 and all hotfixes, patches and driver updates. The DHCP address can be released and renewed manually without issue. There aren't any other network connectivity problems. All other clients and the DHCP server are connected to the 2924 switch.

Searching Google pointed me to a Dell article describing a very similar issue involving Dell switches and turning off Spanning Tree algorithm and turning on fast link

It is not recommended to turn off Spanning Tree, however if necessary it is possible. Use Fast Link if a device is connected to a port that requires network access immediately when the link comes up and cannot wait for a Spanning Tree resolution.  

Fast Link — Immediately enables the port in forwarding state when a link comes up. The port is not part of the Spanning Tree at that time, but will participate in future Spanning Tree resolutions.

Enabling "Port Fast" (Fast Switching) in my Cisco 2924 switch got rid of the warning in the event log.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...