Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Find all past desktop IP addresses

I have a bunch of windows computers and due to a monitoring need I need to check their (static) ip address history.

When the user changes the ip address is there anywhere the ip address gets saved, logged or cached in any form at all? (I don't even need times, the simple ip address would do)

share|improve this question

marked as duplicate by Ƭᴇcʜιᴇ007, Dave M, Siim K, 8088, Nifle Dec 16 '12 at 8:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

If the IP addresses are being changed, wouldn't they be considered Dynamic and not Static? – Django Reinhardt Dec 15 '12 at 17:52
We have static ip addresses assigned to certain machines, but users seem to change them to use the network maliciously, its a bit difficult to get the mac address from the ip, but that a whole different question – Akshat Dec 15 '12 at 17:55
im looking at static addresses not dynamic ones – Akshat Dec 15 '12 at 17:57
xp?vista? win7? group policy? are they local admins? – Logman Dec 15 '12 at 18:09
They are local admins, there isn't a group policy or domain controller being used with Win XP (for compatibility) and Win 7 computers – Akshat Dec 15 '12 at 18:14

You could try the system event log. Filter for source 'iphlpsvc' and Event Id 4200.

EDIT: Turns out this only works on Server (2008R2), even though the 'IP Helper' service is running on Windows 7 as well, it seems it doesn't write anything to the event log.

I had 5 VMs open and picked the wrong one for the test, sorry.

I couldn't find anything in the service config to turn logging on, but that doesn't mean that's not possible, but you will not get past events.

share|improve this answer
Didn't work for me, but Searching the Event log for events produced by such services (and perhaps your network adapter's drivers) are probably the best bet. You should add this answer to the linked duplicate. :) – Ƭᴇcʜιᴇ007 Dec 15 '12 at 18:23

When using TCP/IP on an Ethernet network the ARP traffic reveals physical address (MAC) to IP address mappings. This is done with various announcements and queries the results of which are often cached. A router will usually provide an easy way to list this information. In Windows for IP addresses contacted recently (so they are in the ARP cache) you can use ARP -a to list the information. A Windows AD domain controller is an example of such a machine.

Retrieving this information from a machine/router you control and logging it will even let you spot suspicious new MAC addresses should somebody start changing that as well.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.