Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1053 Source: DHCP

Source
Level
Description
The DHCP/BINL service on this Small Business Server has encountered another server on this network with  IP Address, <IP address>, belonging to the domain: <domain>.
Comments
 
This was happening in one of our customerís office. They have installed Windows 2003 SBS and every time we started the DHCP Service, we received event 1053 and 1054. After a few minutes looking for other DHCP Servers on the network, (no one was found as we expected) we found RRAS was active and it was working as a DHCP server. After stopping the RRAS Service, DHCP was up and working ok.
Event 1053 was followed by event 1054 in the event log. I had 2 NICs on an SBS2003 and the DHCP server service would not start giving me the 1053 and 1054 errors. On the external NICís side, the router was setup as a DHCP server. I disabled the DHCP service on the router and the problem was solved.
As per Microsoft: "This event message indicates the possibility of an unauthorized server on the network. For the directory authorization process to work properly, it is assumed and necessary that the first DHCP server introduced on to your network participate in the Active Directory service. This requires that the server be installed as either a domain controller or a member server. Where you are either planning for or actively deploying Active Directory services, it is important that you do not select to install your first DHCP server computer as a stand-alone server". See MSW2KDB for more details on this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...