Log Change IP: Tracking Network Changes for Security & Auditing

Logging IP address changes in Windows can be achieved by monitoring DHCP events via the Event Viewer or by setting up a custom script to log IP address changes. DHCP events (EventID 50028 for IP added, 50029 for removed) are often the best way to track when a machine receives a new IP address. Methods for Tracking IP Address Changes

Check DHCP Logs (Event Viewer): To track when your computer obtains or changes its IP address from a router, you can check the DHCP client events. Open the Event Viewer.

Navigate to Applications and Services Logs > Microsoft > Windows > Dhcp-Client > Operational.

Look for EventID 50028 (IP address added/plumbed) or 50029 (IP address removed/unplumbed).

Create a Custom PowerShell Script: For more detailed logging, you can create a PowerShell script that monitors IP changes.

Create a script using Get-NetIPAddress to track the current IP.

Configure Task Scheduler to run this script periodically or on network events. Monitor Network Adapter Changes:

Open Control Panel > Network and Sharing Center > Change adapter settings.

Right-click your network adapter (Ethernet or Wi-Fi) and check its Properties > Internet Protocol Version 4 (TCP/IPv4) > Properties to see if it is set to “Obtain an IP address automatically (DHCP)”. How to Check Current IP Address (Step-by-Step)

Command Prompt: Type cmd in the Windows search bar, open the Command Prompt, and type ipconfig to see the current IPv4 address, subnet mask, and default gateway.

Settings: Go to Settings > Network & Internet > Properties for your connection to view current network details. If you’d like, I can:

Provide a PowerShell script to log IP changes to a text file.

Help you set up a custom task to monitor IP address changes.

Explain how to configure a static IP address instead of DHCP. Let me know how you’d like to proceed. How to Change IP Address on Windows ⁄₁₁ (Full Tutorial)