{"id":4331,"date":"2013-01-13T00:01:00","date_gmt":"2013-01-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/01\/13\/weekend-scripter-parsing-the-dhcp-database-no-way\/"},"modified":"2013-01-13T00:01:00","modified_gmt":"2013-01-13T00:01:00","slug":"weekend-scripter-parsing-the-dhcp-database-no-way","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-parsing-the-dhcp-database-no-way\/","title":{"rendered":"Weekend Scripter: Parsing the DHCP Database? No Way!"},"content":{"rendered":"

Summary:<\/strong> Microsoft Scripting Guy, Ed Wilson, talks about a Windows PowerShell function from the DHCPServer module that permits parsing the DHCP database.<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Give us enough time, and eventually we get it right. Yes, it is now possible to use Windows PowerShell to parse the DHCP server database of IPv4 leases (you can also parse the IPv6 lease database as well). Why is this good news? Well, first of all, DHCP uses an .mdb <\/em>file format and, as most people know, that is a “standard jet database” format. Microsoft Access used to use an .mdb <\/em>file format, and so one should be able to query the DHCP database by using standard database types of tools. Well, actually until Windows Server 2012 that was not supported.<\/p>\n

Note<\/strong>   This is the fourth article in a series of Hey, Scripting Guy! Blog posts where I talk about using Windows PowerShell to work with Microsoft DHCP servers. I began the series with Use PowerShell to Query AD DS for DHCP Servers<\/a>, <\/em>in which I talked about using the Get-ADObject<\/strong> cmdlet to query for DHCP servers. I followed this with Use PowerShell Functions to Authorize DHCP Servers<\/a>. <\/em>In this blog post, I talked about using several Windows PowerShell functions from the DHCPServer module. I query for DHCP servers, authorize DHCP servers, and deauthorize DHCP servers in this article. Yesterday, I wrote Weekend Scripter: DHCP Address Conflict Detection<\/a> <\/em>in which I talked about making changes to the DHCP server configuration. Today’s post builds on these articles, and I recommend you read them in order as I am not level-setting in each article.<\/p>\n

Query the DHCP IPv4 lease database<\/h2>\n

Well, why would one want to query DHCP? For one thing, on a really small network that might not really be necessary. I might just as well use the DHCP tool. The DHCP tool is shown here.<\/p>\n

 \"Image<\/a><\/p>\n

Of course, there are a couple of problems with using the DHCP tool. First, it is slow to make the connection. Next, it requires a decent amount of mousing around, and last of all, it always prompts to save changes (even if I have made no changes and cannot tell what it really does with this prompt anyway).<\/p>\n

Now with Windows PowerShell, it is fast—I do not even need to load the DHCPServer module because with Windows PowerShell 3.0, it auto-loads.<\/p>\n

There are a number of occasions when querying the DHCP server IPv4 lease database makes sense, as listed here.<\/p>\n

    \n
  1. To check on IP address use.<\/li>\n
  2. To check IP lease expiration.<\/li>\n
  3. To map MAC addresses to IP addresses.<\/li>\n<\/ol>\n

    There are other pieces of information available as well, such as NAP status, DHCP policy enforcement, DNS registration info, and even end-time of probation period.<\/p>\n

    First find the available scopes<\/h2>\n

    The first thing I need to know is what DHCP IPv4 scopes reside on the DHCP server. To find this information, I use the Get-DhcpServerv4Scope<\/strong> function and specify the computer name. To query a specific DHCP server, use the server name or IP address. The ComputerName<\/strong> <\/em>parameter is not a default parameter, and therefore, when not present, the function attempts to query the local computer. Also the ComputerName<\/strong> <\/em>parameter is not positional, and therefore, when left off, an error arises. Luckily, the ComputerName<\/strong> <\/em>parameter has an alias of CN<\/strong>, <\/em>and therefore, I can avoid typing the long parameter name, as shown here.<\/p>\n

    PS C:\\> Get-DhcpServerv4Scope -cn wds1<\/p>\n

    ScopeId         SubnetMask      Name           State    StartRange      EndRange<\/p>\n

    ——-         ———-      —-           —–    ———-      ——–<\/p>\n

    192.168.0.0     255.255.255.0   lan            Active   192.168.0.40    192.168.0.90<\/p>\n

    192.168.2.0     255.255.255.0   WireLess       Active   192.168.2.50    192.168.2.99<\/p>\n

    192.168.3.0     255.255.255.0   Autodeploy     Active   192.168.3.1     192.168.3…<\/p>\n

    Query the DHCP server lease database<\/h2>\n

    Now that I know what scopes reside on the DHCP server, I can query for lease assignments by scope. This is shown here.<\/p>\n

    PS C:\\> Get-DhcpServerv4Lease -ComputerName wds1 -AllLeases -ScopeId 192.168.0<\/p>\n

    IPAddress       ScopeId         ClientId             HostName             AddressSta<\/p>\n

                                                                              te<\/p>\n

    ———       ——-         ——–             ——–             ———-<\/p>\n

    192.168.0.40    192.168.0.0     c4-3d-c7-a2-87-eb                         Active<\/p>\n

    192.168.0.41    192.168.0.0     00-1d-7e-62-29-78    Router1.iammred.net  Active<\/p>\n

    192.168.0.42    192.168.0.0     f0-de-f1-7d-97-7c    edLT.iammred.net     Active<\/p>\n

    192.168.0.43    192.168.0.0     e0-69-95-36-4e-e5    Hyperv3.iammred.net  Active<\/p>\n

    192.168.0.44    192.168.0.0     c0-3f-0e-3b-58-b6                         Active<\/p>\n

    192.168.0.45    192.168.0.0     00-21-86-52-f0-d6    EDWILSON_LT.north… Active<\/p>\n

    192.168.0.46    192.168.0.0     00-24-e8-3e-99-2a    hyperv2.iammred.net  Active<\/p>\n

    192.168.0.54    192.168.0.0     00-15-5d-00-2d-16    Web1.iammred.net     Active<\/p>\n

    Now, if I am interested in a specific computer, I can use regular Windows PowerShell filtering techniques. I do not need to type the entire DNS host name—I can use the match operator to filter out part of the host name, as shown here.<\/p>\n

    PS C:\\> Get-DhcpServerv4Lease -ComputerName wds1 -AllLeases -ScopeId 192.168.0 | ?<\/p>\n

     hostname -match edlt<\/p>\n

    IPAddress       ScopeId         ClientId             HostName             AddressSta<\/p>\n

                                                                              te<\/p>\n

    ———       ——-         ——–             ——–             ———-<\/p>\n

    192.168.0.42    192.168.0.0     f0-de-f1-7d-97-7c    edLT.iammred.net     Active<\/p>\n

    If I want to see full lease information for the edLT computer, I pipe the results of the previous command to the Format-Table<\/strong> cmdlet (fl<\/strong> is the alias for this cmdlet). The command and the associated information returned by the command appear in the image that follows.<\/p>\n

    \"Image<\/a><\/p>\n

    If I want to look at the DHCP lease expiration dates, I select the LeaseExpiryTime<\/strong> property. The following command selects the IP address, the host name, and the lease expiration time, and then sorts the results by expiration time in ascending fashion.<\/p>\n

    15:16 C:\\> Get-DhcpServerv4Lease -ComputerName wds1 -AllLeases -ScopeId 192.168.0 |<\/p>\n

    select ipaddress, hostname, leaseExpiryTime | sort leaseExpiryTime<\/p>\n

    IPAddress                    hostname                    leaseExpiryTime<\/p>\n

    ———                    ——–                    —————<\/p>\n

    192.168.0.43                 Hyperv3.iammred.net         1\/17\/2013 1:59:53 PM<\/p>\n

    192.168.0.44                                             1\/17\/2013 2:10:22 PM<\/p>\n

    192.168.0.40                                             1\/17\/2013 4:47:30 PM<\/p>\n

    192.168.0.54                 Web1.iammred.net            1\/18\/2013 3:25:44 AM<\/p>\n

    192.168.0.41                 Router1.iammred.net         1\/18\/2013 11:17:34 AM<\/p>\n

    192.168.0.46                 hyperv2.iammred.net         1\/18\/2013 9:47:54 PM<\/p>\n

    192.168.0.42                 edLT.iammred.net            1\/19\/2013 9:38:18 AM<\/p>\n

    192.168.0.45                 EDWILSON_LT.northamerica… 1\/19\/2013 9:40:15 AM<\/p>\n

    One more cool thing today, and then I need to leave for the airport for my trip to Redmond. At times, I need to work with a class of machines that all came from the same maker at the same time. In all likelihood, these machines will have similar MAC addresses because the first three hexadecimal numbers identify the maker<\/a>. For example, a MAC prefix of 00-15-5d belongs to the Microsoft Corporation and might be found in use by a virtual machine. The following illustrates this technique.<\/p>\n

    15:19 C:\\> Get-DhcpServerv4Lease -ComputerName wds1 -AllLeases -ScopeId 192.168.0 |<\/p>\n

    ? clientID -match ‘^00-15-5d’<\/p>\n

    IPAddress       ScopeId         ClientId             HostName             AddressSta<\/p>\n

                                                                              te<\/p>\n

    ———       ——-         ——–             ——–             ———-<\/p>\n

    192.168.0.54    192.168.0.0     00-15-5d-00-2d-16    Web1.iammred.net     Active<\/p>\n

    I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

    Ed Wilson, Microsoft Scripting Guy<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

    Summary: Microsoft Scripting Guy, Ed Wilson, talks about a Windows PowerShell function from the DHCPServer module that permits parsing the DHCP database. Microsoft Scripting Guy, Ed Wilson, is here. Give us enough time, and eventually we get it right. Yes, it is now possible to use Windows PowerShell to parse the DHCP server database of […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[218,37,3,61,45],"class_list":["post-4331","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-dhcp-server","tag-networking","tag-scripting-guy","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

    Summary: Microsoft Scripting Guy, Ed Wilson, talks about a Windows PowerShell function from the DHCPServer module that permits parsing the DHCP database. Microsoft Scripting Guy, Ed Wilson, is here. Give us enough time, and eventually we get it right. Yes, it is now possible to use Windows PowerShell to parse the DHCP server database of […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4331"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4331\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}