The current LEM DHCP Connector monitors the Windows System Log for DHCP events but Lease Assignments do not appear to be logged here by default. That information appears to only be logged in the DHCP audit log. See TechNet Article: More About DHCP Audit and Event Logging. In it, it states: In Windows Server 2008, DHCP server log files are configured to manage log file growth and conserve disk resources by default. DHCP audit logs are located by default at %windir%\System32\Dhcp.
I verified this log path and lease assignments are listed in it but it does not appear to match the default location of the DHCP connector. Is there a different tool or do I need to enable different auditing for these events to be listed in the Windows System event log?
I too would like to record DHCP lease assignments in LEM for forensics.