none
DHCP WMI Event Classes RRS feed

  • Question

  • I'm working towards creating instrumentation to auto-remediate DHCP BAD_ADDRESS issues that can occur for a variety of reasons and which can result in scope exhaustion in some circumstances if not addressed.

    There are PowerShell CmdLets to help identify and clean up BAD_ADDRESSES (Get-DhcpServerv4Lease -BadLeases and Remove-DhcpServerv4Lease -BadLeases), however, I've been searching for a more event-driven approach in order to respond more rapidly and also so that the automation isn't constantly hammering DHCP to search for bad addresses.

    Usually WMI is a good source to leverage for event-driven activities and although I did find that there's a WMI class (PS_DhcpServer4Lease) to perform the equivalent of the PowerShell CmdLets above (finding/removing bad addresses), I'm not finding any WMI Event Classes that might allow me to create a subscription in order for an event notification to trigger remediation.

    I've scanned WMI on a DHCP server to identify all existing WMI Providers, Namespaces, and related Classes that I could identify. 'DhcpServerPSProvider' appears to be the only WMI Provider related to DHCP, and the following is the namespace that appears to be associated with it: 'ROOT\Microsoft\Windows\DHCP'

    The Provider Classes are clearly documented here.

    I attempted to look for any DHCP related Event Classes using the following query within both the 'ROOT\Microsoft\Windows\DHCP' and 'root\cimv2' namespaces but no luck.

    Get-WmiObject -Namespace ROOT\Microsoft\Windows\DHCP -Query "SELECT * FROM meta_class WHERE __This ISA '__Event'" | sort | select name

    Would really appreciate some help here with identifying whether a WMI Event class exists that I might be able to subscribe to for BAD_ADDRESS events. There's quite a bit of other similar instrumentation I'd like to work on as well so if there are DHCP related WMI Event classes at all that can be subscribed to then I'd appreciate a reference. Thanks!

    Tuesday, September 19, 2017 4:25 AM

All replies

  • Hi,

    Since the issue is more related with powershell , please have this asked in powershell Forum for better answers.

    https://social.technet.microsoft.com/Forums/windows/en-US/home?forum=winserverpowershell

    I have a simple suggestion for you:

    run powershell script(Get-DhcpServerv4Lease -BadLeases and Remove-DhcpServerv4Lease -BadLeases) by task scheduler in interval time.

    Best Regards,

    Frank


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, September 20, 2017 6:56 AM
  • Thanks Frank.

    I consider this related more to DHCP and/or WMI than PowerShell ... I just happen to be using PowerShell to create the instrumentation but will gladly use another language if it helps me accomplish an event-driven approach.

    And yes, as indicated earlier, if I can't identify a WMI Event Class or another mechanism to achieve an event-driven auto-remediation then I plan to use those PowerShell Cmdlets within a DSC resource to auto re-mediate on a schedule.

    Appreciate your feedback.

    Thanks

    Ted


    • Edited by Ted A. B Wednesday, September 20, 2017 5:47 PM
    Wednesday, September 20, 2017 5:47 PM
  • Hi,Ted

    Because some Powershell commands use wmi interface to run, so experts of powershell forum know more about wmi.

    Thanks for your support and understanding

    Best Regards,

    Frank


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Thursday, September 21, 2017 2:07 AM
  • Hello Frank,

    I understand that perspective and it won't hurt to pose the scenario on that forum. But to be clear, WMI is just one path that I'm searching to identify the means to the solution I'm exploring.

    Hopefully one of the DHCP experts on this forum might be able to interject regarding if DHCP even exposes an option for an event-driven approach - whether via WMI or some other mechanism.

    Thanks again,

    Ted

    Thursday, September 21, 2017 5:49 PM
  • Hi,Ted

    Thanks for your support.

    Best Regards,

    Frank


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, September 25, 2017 2:01 AM