Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1005 Source: DHCP

DHCP failed to renew a lease for the card with network address <MAC address>. The following error occurred: The semaphore timeout period has expired.
From a newsgroup post: "Initially it sounds as if there may be something wrong with the ARP (Address Resolution Protocol) cache on a switch or router in place. I would try the following:
1) Check the WINS entries to see if there were any problems there.
2) When you get that error message, give the server another IP address, and see if you can ping the address that is in conflict. Ping with the -a switch to see what name resolves. Ex: ping -a
3) I would then reboot the routers/switches to clear out any ARP cache that may be corrupt".
Using a NT Workstation I found that by releasing the ip address with IPconfig and restarting the PC the problem is resolved. My error came about when the dhcp server had crashed during the 50% lease renew time of the client.
Some users claim they had the same error and just re-applied the service pack to fix it.
Under Windows 2003 server(RC2) with ISA Server 2000 installed, a problem appeared where the network connection was automatically disabled by Windows 2003 server. This happened when the connection to the ISP (which uses DHCP to assign addresses) was lost and then subsequently re-connected. Curiously, the event log shows many attempts to renew the ip address....all of them being completely different ip addresses from the previous; but Windows 2003 server disabled the NIC anyway. Only a reboot of the server fixed this problem.
From the Resource Kit:
"By default, the client tries to renew its lease for an Internet Protocol (IP) address when 50 percent of its lease time has expired. The attempt to renew the lease has failed.

Make sure that the computer is physically connected to the network and that the network adapter is correctly configured. If you confirm both of these, check with the network administrator to verify that the IP address has not been deleted from the Dynamic Host Configuration Protocol (DHCP) server scope. If all these conditions are met, try using the command ipconfig at the command prompt to release the current IP address and get a new IP address."

Microsoft recomend using a static ip address to resolve this issue, but I found removing the machine from the domain, re-installing the NIC and then re-adding the machine to the domain resolved the issue.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.