Set up DHCP Auditing
DHCP stands for Dynamic Host Configuration Protocol. The DHCP service automatically issues IP addresses to the workstations in a network. The central branch of DHCP is the integration in DNS (Domain Name System). The goal of the integration is the automatic registration of host names and IP addresses with DNS servers by the DHCP server.
The client sends a DHCP Discover (Broadcast) to the network and expects a DHCP Offer (an IP address offered) from an existing DHCP server. The client accepts the offered IP address (DHCP Offer) and sends the DHCP server a DHCP request (I accept your offer). The DHCP server confirms with a DHCP-Acknowledge (we are in business). If no DHCP server is reached, the client receives a provisional IP from the area 169.254.0.1 - 255.254 via APIPA (Automatic Private IP Addressing).
To track such actions, it is important that the auditing feature be enabled.