Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1004 Source: DHCP

The DHCP Client service is shutting down. The following error occurred: <error>.
I had this error on a 2003 R2 SP2 DC. Turned out to be the permissions issue. What gave me a bit of trouble was broken inheritance of rights on the HKLM\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters subkey. I had tried setting the 'Full Control' right to 'Network Services' account on the Dhcp key and checked inheritance - but didn't think of the possibility of broken inheritance.
WITP83228 provides information that can help you solve this problem.
Check registry permissions on the HKLM\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters registry key. I had this error in Win2003 when the NETWORK SERVICE group did not have Full Control.

With error Access Denied (Error code 5), you can determine the registry keys which have to be fixed, by using Process Monitor from Sysinternals. Define the filter as “errors only”, and then try to start the DHCP client service.
According to Microsoft, this event record indicates that the DHCP database is corrupted. See MSW2KDB for more details on this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.